Why Visa And Mastercard Are Playing Ball on Tokens

Since 2014, Visa Inc. has been tokenizing Visa-branded payment cards and Mastercard Inc. has been tokenizing Mastercard-branded cards, but neither network has had access to tokens for cards branded by the other network. Now, that’s about to change.

Under an agreement announced last month by Visa and Mastercard, Visa will be able to request tokens from Mastercard for Mastercard-branded cards consumers want to load into Visa Checkout, and Mastercard will be able to do likewise for Visa Cards digitized for Masterpass.

The reciprocity agreement will let each network access the other network’s token engine via an API call, says James Anderson, group executive for platforms and emerging payments at Mastercard. It will take effect during the coming year, rolling out across the networks’ global regions. “It will certainly be during 2017,” Anderson says. “We have to do some work, but that work is under way already.”

“Product teams have just started working together,” adds Vish Shastry, a vice president for digital products at Visa. “We’ll load by geography,” though the U.S. market is likely to be enabled early on, he says.

The pact, which formally links the Mastercard Digital Enablement Service and the Visa Token Service, comes as the payments business braces for increasing fraud in digital channels with the rollout of EMV chip cards in stores.

Up to now, cardholders could load, for example, a Visa card into their Masterpass digital wallet but what was loaded was the actual card credential, not a token masking the credential. Those credentials are prized by cyberthieves and have been the target of countless data breaches.

Tokens are random strings of characters that stand in for data like actual card numbers and expiration dates. Token services, such as those of Visa and Mastercard, keep track of these tokens and match them up with the real card credentials when issuers need to authorize transactions.

In this way, tokenization is seen as a bulwark against fraud. Reciprocal tokenization should spread that security blanket much farther, the networks say. “Just simplifying payments is just half the problem. We want to increase security with fraud moving to the card-not-present channel,” says Shastry.

There is a notable imbalance between the two network giants. As of Sept. 30, there were 380 million Mastercard-branded credit and debit cards circulating in the United States, while Visa-branded U.S. payment cards numbered 851 million as of June 30, well more than double the Mastercard count.

Relying on these numbers, the latest available, it would appear that by customary terms Visa could generate more token fees from the arrangement than Mastercard, though this scenario ignores the relative number of Visa Checkout and Masterpass wallets currently in use.

There are also differences in the two products. Mastercard, which relaunched Masterpass last summer, positions the wallet for in-store as well as in-browser and in-app transactions. Visa Checkout can be used only for online and in-app purchases.

Neither Shastry nor Anderson will discuss the commercial terms behind the agreement, in particular any fees or other consideration that will pass between them for tokenization. “We were able to get very comfortable” with the terms of the deal, Anderson says, noting he can’t go any farther.

Some observers say it’s possible token fees are not even involved. “It wouldn’t surprise me at all if there were no financial exchange” between the networks, says Rick Oglesby, principal at AZ Payments Group LLC, a Mesa, Ariz.-based consultancy.

Both Visa and Mastercard tout their digital wallets as “open” to any payment card the consumer wants to load, yet the reciprocity agreement comes two years after the networks set up their token engines. Anderson and Shastry acknowledge the lag but attribute it to the complexity of negotiating with a competitor. “It took a little while for us to get to a place where we could figure out the best construct,” says Shastry.

Oglesby notes that the timing of the reciprocity agreement could indicate both wallets are meeting expectations. “It means they’re making some good progress in gaining multicard enrollment,” he points out.

Visa and Mastercard remain non-commital, however, on whether other networks, such as American Express Co. or Discover Network, might be embraced in future reciprocal agreements. “We don’t have anything to announce at this time,” Shastry says, while adding that the accord with Mastercard covers “the majority of cards.”