ADDING VALUE TO SECURITY. How Issuers Can Leverage Tokenization to Capture New Revenue-Generating Opportunities. firstdata.com

Transcription

1 A First Data Position Paper ADDING VALUE TO SECURITY How Issuers Can Leverage Tokenization to Capture New Revenue-Generating Opportunities firstdata.com

2 Introduction The payments world is undergoing a major transformation as commerce goes digital. Digital payments topped $645 billion in the U.S. in 2016, and with mobile commerce (mcommerce) increasing 61.6 percent annually, mcommerce is expected to reach $284 billion in the U.S. by Meanwhile, the maturation of the Internet of Things (IoT) comprising more than 8.4 billion connected devices worldwide is poised to drive an incredible $1.29 trillion in global spending by In the U.S., payment cards remain consumers preferred method of payment. 3 But with three in four Americans (77%) now carrying smartphones, consumers want to use these cards to make digital payments via mobile wallets like the Apple Pay wallet. 4 The number of mobile payment users in the U.S. is projected to reach 150 million by , and Apple is seeing 500-percent year-over-year growth in transaction volume with its Apple Pay wallet. 6 These mobile wallet users are making digital transactions virtually anytime, anywhere even in-store, where mobile payments already account for $75 billion in the U.S. 7 Major digital players like Amazon, Facebook, PayPal and Apple are accelerating this shift, making big investments in online and mobile payment solutions. However, as payments go digital, fraudsters go digital as well and the recent U.S. EMV shift compounds this fraud risk. While the EMV shift reduced point-of-sale (POS) fraud, fraudsters have refocused on digital transactions following patterns previously seen in Europe and Canada. As a result, 2016 saw card-not-present (CNP) fraud increased 40 percent, as well as a record-high level of overall fraud, totaling more than $16 billion in losses. 8 MOBILE PAYMENTS GROWING RAPIDLY MOBILE PAYMENTS WILL ACCOUNT FOR NEARLY OF ALL COMMERCE VOLUME 9 HALF BY 2020: mcommerce WILL REACH $284B IN THE U.S. 10 APPLE PAY TRANSACTION VOLUME IS GROWING 500% YOY 11 firstdata.com 2017 First Data Corporation. All Rights Reserved. 2

3 Issuers Recognize Payment Tokenization Benefits For issuers, the need to enable seamless digital payment experiences via mobile wallets like Apple Pay, while mitigating the rapidly growing risk of CNP fraud, is now driving another momentous shift toward tokenization of primary account numbers (PANs) and other sensitive consumer credentials. Tokenization, in conjunction with security elements like 3D-secure and end-to-end encryption, creates layered digital protection that plugs many of the gaps that emerge when payments move from the physical to the digital world. INCREASING DIGITAL COMMERCE DRIVING RECORD-HIGH FRAUD 40% INCREASE IN CNP FRAUD Yet, many issuers continue to view tokens as purely an operational security matter simply the next required step in the evolution of payment security. But industry experts point out that the move to tokenization is on the same scale as previous transformations from bartering to gold, from gold to currency, and from cash to checks and plastic. Like the major payment transformations before it, tokenization promises to enable new kinds of commerce and to expand the range of paymentadjacent services to bring new value to consumers. To survive and thrive in the rapidly evolving payments world, issuers must understand the broader impacts of tokenization and take steps today to position themselves to capture the powerful revenue-generating opportunities that tokenization can bring. A Short Background of Tokenization Tokenization is based on a simple idea replacing highvalue financial instruments with surrogate equivalents that has been used by just about every civilization going back to the Roman empire. Jumping forward to the digital age, early data processing engines in the 1970s first applied tokenization to allow sensitive data elements to be transferred between databases and systems, replacing that sensitive information with encrypted tokens that could be decrypted once they reached their destination. But it wasn t until the introduction of Apple Pay in 2014 that tokenization became a mainstream concept in the payments world. To build the payment infrastructure to drive its mobile wallet, Apple partnered with Visa TM, MasterCard and American Express to develop an EMVCo-enabled tokenization structure that would serve as one of the critical technologies underlying its Apple Pay solution $16B IN OVERALL FRAUD LOSSES IN EMVCo is a consortium with control split equally among Visa, MasterCard, JCB, American Express, China UnionPay and Discover. Supported by banks, merchants, processors, vendors and other industry stakeholders, EMVCo manages and evolves the EMV Specifications and related testing processes as it facilitates worldwide interoperability and acceptance of secure payment transactions. The resulting EMVCo-enabled structure allows tokenization to be mapped to the traditional PAN-based world of digital transactions. As a first-ofits-kind framework, issuers are required to adopt the EMVCo standards in order for their card products to be compatible with the Apple Pay wallet. With Apple Pay s tremendous growth 300-percent increase in users and 500-percent year-over-year increase in transaction volume in ; acceptance at 20 million locations in 15 countries 14 it s no surprise that the EMVCo is now the default industry standard. firstdata.com 2017 First Data Corporation. All Rights Reserved. 3

4 HOW TOKENIZATION WORKS Tokenization Offers Unmatched Payment Security Across All Channels In the simplest sense, tokenization replaces a cardholder s PAN with a randomly generated number (the token) that has no intrinsic value. The merchant sends a request through the merchant acquirer to the token service provider (TSP) the only actor with the keys to connect the token with a PAN and unlock or authorize the transaction. The TSP connects with the issuer to verify funds, and the authorization is passed back to the merchant. No actual consumer credentials are shared with the merchant or the merchant s system(s). Even if a merchant or network is breached, the encrypted tokens are worthless. Moreover, tokenization delivers a level of granular security and control that is superior to almost anything else in the payment world today. Unlike the static PAN, the dynamic token has virtually unlimited parameters, including merchant-specific tokens, use case-specific tokens, time-sensitive tokens and one-time-use tokens. CUSTOMER MERCHANT ACQUIRER A customer makes a payment online or in-store via mobile device with an embedded token (e.g., Apple Pay wallet). The token is passed from the mobile device to the Merchant system. The Merchant passes the token to the Merchant Acquirer. 4 The Merchant Acquirer passes the token to the Token Services Provider (TSP). TOKEN VAULT 5 The TSP matches the token with the customer PAN via the Token Vault. TSP 6 The TSP routes authorizations to the Issuer. 7 The Issuer verifies funds and authorizes the payment/transaction. ISSUER 8 The authorization is passed back from the Issuer, to the Merchant Acquirer and finally to the Merchant, completing the transaction. firstdata.com 2017 First Data Corporation. All Rights Reserved. 4

5 Tokenization Benefits to Issuers and Cardholders CARDHOLDERS Omnichannel Freedom: Cardholders gain the freedom of omnichannel transactions while enjoying superior security. Personalization: Because merchants can store customer information securely, cardholders enjoy simpler, more personalized experiences. Convenience: Because tokenization effectively eliminates the PAN, if a cardholder loses a physical card, digital payment credentials usually do not have to be updated on websites, online payment platforms, etc. The cardholder is issued a new card but the stored tokens remain the same. ISSUERS Digital Payment Foundation: Tokenization is the foundation step for any digital payment strategy, providing a modern level of digital security for in-app, CNP and POS transactions. Fraud Reduction: Greater data security and encryption can help reduce the risk of data breach, as well as the impacts in the case of a breach. Dynamic token parameters give issuers greater control over how and where a card is used, further mitigating potential fraud. Revenue Preservation: Because tokenization is mapped to the existing PAN framework, issuers can maintain their transaction cost structure. Interchange revenue remains intact because digital payment tokenization is credit-and debit-driven, which provides a profitable alternative to other digital wallets driving ACH payments. TOKENIZATION firstdata.com 2017 First Data Corporation. All Rights Reserved. 5 First Data s Response

6 Tokens as the Superhero The incredible potential of tokenization stems from the move from a static credential (the PAN) to a dynamic credential (the token) with nearly infinite parameters. Along with the PAN, the dynamic token can carry highly granular domain restrictions governing how the credentials can be used. The dynamic token can also carry data linked to value-added services. The token can even carry parameters defining how specific transactions are routed. It s easy, then, to envision the token in a superhero role for issuers actively providing them an unprecedented level of visibility into consumer transactions and giving them an entirely new level of control over those transactions. Uncovering the Full Value of Tokenization Issuers recognize that tokenization is the framework upon which the fundamental future of payments will be built. Tokens can enable new kinds of digital payment experiences. Because a token directly links to a PAN, tokens can be stored on mobile devices, in mobile apps and on other digital, connected devices, enabling consumers to conduct transactions through these digital channels in a more seamless and secure manner. Perhaps more importantly for issuers, by providing a secure way to embed consumer credentials and information of all kinds not just PANs in digital experiences, tokenization opens up an enormous range of opportunities for new and enhanced payment-adjacent value-added services, including: Enhanced fraud management: Enhanced transaction tracking enables predictive modeling for a proactive approach to fraud detection and prevention. Credential management: New ways to securely store customer credentials to bring new levels of convenience and seamlessness to digital experiences. Rewards and loyalty: Enhancing customer tracking to drive more personalized rewards offerings, as well as enable more seamless reward/points redemption. Marketing analytics: Leveraging enhanced consumer data to drive predictive analytics that can help identify customer needs and qualify targets. Customer Relationship Management (CRM) integration: Connecting consumer data to payment data to track consumer behavior and reveal actionable insights for marketing, sales and even product development teams. In fact, EMVCo recently released an update to its tokenization framework the EMV Payment Tokenization Specification Technical Framework v2.0 that specifically addressed the expanding use cases for tokens beyond card-on-file transactions. 15 The most important part of this update are specifications that allow for tokens with values other than the PAN. firstdata.com 2017 First Data Corporation. All Rights Reserved. 6

7 Recognizing Revenue-Generating Use Cases For issuers, meeting consumer demands for seamless, secure digital transactions is as important as driving revenue. Fortunately, the expanding use cases for tokenization can help solve both of those challenges. Here are a couple of examples: Instant digital issuance: Re-issuing cards can present a major risk and challenge for issuers. If cardholders must re-enter new card information into the mobile wallet, there s a significant chance they simply won t do it or may shift their mobile wallet purchases to another card. Tokenization presents a solution to this problem, enabling issuers to instantly issue payment credentials without having to issue new plastic. Even if a physical card needs to be re-issued because of damage, fraud or expiration, the digital credential will remain in the mobile wallet without interruption. This empowers issuers to maintain top-of-wallet placement in mobile wallets, maintaining usage and card revenue. Rewards and loyalty programs: The flexibility of tokens creates opportunities to develop more personalized customer loyalty programs and digital rewards. Loyalty programs are evolving to include painless enrollment, frictionless participation and effortless security, and to integrate rewards redemption into the digital payment experience. Because tokenization can significantly enhance customer-tracking capabilities, issuers can leverage a more robust stream of customer data to drive personalized loyalty and rewards programs. Issuers Should Maximize Control of their Tokenization Ecosystem While the potential of tokenization is broad and significant, up to now, security has been the primary driver of the shift to payment tokenization. Looking forward, issuers should also consider which technology partner can help them build a tokenization strategy that is open to multiple business models; protects payment credentials and related transaction information; is standards-based; supports long-term viability, and meets the needs of consumers. In short, issuers should look to maximize visibility and control over their tokenization ecosystem today while ensuring that they are well positioned to take advantage of revenue-generating use cases of tokenization in the future. Integrated digital rewards redemption, such as pay-with-points, allow transactions to be split between points and currency. These offerings can be highly customized to fit issuer rewards programs - enabling seamless consumer transactions, helping drive revenue, and maximizing customer retention. firstdata.com 2017 First Data Corporation. All Rights Reserved. 7

8 A Single-Source Solution for Tokenization First Data Simplifies the Transition to Tokenization As one of the leading global commerce enablers, First Data is uniquely positioned to help issuers make a fast, smooth and cost-effective transition to tokenization optimizing revenue, reducing complexity and enhancing the overall customer experience. First Data Integrated Token Services offer a single-source gateway to the Token Service Provider payment network, providing the technology and tokenization infrastructure issuers need now to help protect their businesses and their cardholders. This solution set is built on our deep experience and broad established relationships, making it easier to bring safety and security to mobile, online and POS transactions while providing issuers with the control and agility to help capture new opportunities, create new products and deliver new value-added services as tokenization use cases evolve. Protecting Customer Data: Proven token security As one of the most trusted names in the payments world, First Data has stayed at the forefront of tokenization. Our legacy of innovation in payment security continues to give issuers state-of-the-art protection for their customers and their businesses. Maximizing Issuer Choice & Flexibility: A one-stop shop for all tokenization frameworks First Data empowers issuers with greater choice through a flexible framework that allows issuance of major card brands through an EMVCo-enabled framework, as well as a wide range of custom, non-emvco token offerings, including multiple tender types beyond cards. This holistic approach enables payment cards to be used for multiple types of digital commerce, including mobile wallets, in-app card registration and ecommerce card registration. Creating New Revenue-Generating Opportunities: Unmatched valueadded offerings First Data already provides issuers with a wide range of industry-leading value-added services that help drive customer satisfaction and retention. We soon will provide rewards program integration, customer support services and incentive pricing structures value-added support when and where issuers need it. Simplifying Operations: End-to-end support and a unified token management platform Our processing platform provides a single system of record that integrates across multiple Association payment providers. Issuers can manage the entire account lifecycle from one unified platform, with end-to-end support from First Data: Provisioning: Token provisioning based on issuer-defined data elements and card data validation as requested by TSPs. Authorization: Secure receiving, storage and forwarding of token information and PAN data. Reporting: Comprehensive documentation of all token activity enables clear and robust reporting capabilities. Maintenance: Intuitive portal for token maintenance suspending, deactivating or other token status changes. Reducing Time-to-Market: Easy onboarding Our issuer onboarding program accelerates operations from day one helping an issuer make a fast transition to payment tokenization, minimizing costs and reducing time-to-market. We also provide comprehensive training resources for technical and customer service teams. All of this helps issuers bring mobile wallet capabilities to market significantly faster. firstdata.com 2017 First Data Corporation. All Rights Reserved. 8

9 Conclusion Maximizing the Digital Wallet Opportunity for Issuers With digital transactions growing steadily and mobile payments poised to claim nearly half (45%) of all commerce volume by 2020, tokenization provides the critical underlying framework for the next payments transformation. 16 Security is undoubtedly the biggest driver of this transformation, as issuers turn to tokenization to meet evolving industry security standards and rising consumer expectations for secure digital transactions. But as they make this transition, issuers should look to build a tokenization ecosystem that maximizes flexibility and provides control and visibility over customer and transaction data. Issuers can now enable new digital payment experiences that capture the significant revenue-generating opportunities soon to be unlocked by tokenization, delight customers by seamlessly embedding payments in connected devices, and fully capture the digital wallet opportunity. 1 BI Intelligence: 2 IDC: 3 TSYS: 4 Pew Research: 5 BI Intelligence: BI Intelligence: 8 Javelin Strategy: 9 BI Intelligence: 10 BI Intelligence: EMVCo: 16 BI Intelligence: firstdata.com 2017 First Data Corporation. All Rights Reserved. 9

10 CONTACT US TODAY Learn more about how we are helping financial institutions make consumers payment transactions more reliable, secure and convenient. firstdata.com EMV is a registered trademark or trademark of EMVCo LLC in the United States and other countries. Apple Pay is a trademark of Apple, Inc First Data Corporation. All Rights Reserved. The First Data name, logo and related trademarks and service marks are owned by First Data Corporation and are registered or used in the U.S. and many foreign countries. All trademarks, service marks and trade names referenced in this material are the property of their respective owners.