COMMENTARY: Payments Security Requires Tokenization, Biometrics—And You

Digital payments are on the rise, and so is payment fraud. As of 2020, nearly 80% of Americans used at least one form of digital payment. Between 2020 and 2021, payment fraud attacks rose dramatically on digital wallets (200%), payment service providers (169%) and crypto exchanges (140%).

To keep up with customer expectations, merchants need to continue offering the digital payment methods consumers want to use. But as cybercriminals increasingly target these offerings, organizations have a responsibility to keep sensitive data safe. The answer? Tokenization.

Tokenization in payment processing involves swapping a primary account number (PAN) for a non-sensitive surrogate value. The process offers security and convenience that benefits all players in the payment ecosystem—and we’re only just starting to scratch the surface of tokenization’s value to the payments industry. Many major organizations already use tokenization to power biometric authentication and cross-device payment capability to create easier and more secure digital transactions.

Tokenized payments are revolutionizing the entire global finance sector, bringing unprecedented convenience and security to digital payments. The market today is such that organizations must be able to tap into the full potential of tokenization to stay ahead of the competition and build trust with customers.

Tokenized payment processing protects high-risk purchaser data to prevent data breaches and maintain customer loyalty. When using a token, the purchaser’s PAN remains hidden in a secure off-network location. Meanwhile, the tokens themselves are effectively worthless and merely act as a placeholder.

On an Apple Wallet, for example, consumers’ card numbers are listed as representative token codes, while the real credit or debit card information is safely stored with, and backed by, the issuing bank. So even if the device associated with that Apple Wallet is stolen, payment information can’t be accessed and used for fraudulent transactions. Tokenization acts as a moat or barrier between hackers and cardholders’ data.

So, if tokenization is the moat, think of biometrics as the castle walls. Unlike two-factor authentication PINs, unique biometric features like fingerprints, faces, irises, or voices can’t be skimmed off an ATM or stolen with an over-the-shoulder glance in the checkout line. And since biometric identifiers are processed through tokenization, hackers are unable to trace that data back to the source.

With tokenization, customers get more than just peace of mind. They’re getting faster ways to pay across more channels. Tokenized transactions use software algorithms—known as smart contracts—to automate stages of the payment process and complete exchanges faster. Returning buyers can then store their card information for recurring or one-click payments, granting quicker access to merchants’ products and services.

For two-factor authentication, biometric identification is practically frictionless, adding mere seconds to the digital payment experience. Customers only need to tap their finger on their phone or complete a quick facial scan from a camera.

Tokenization and biometrics can be applied across a wide range of payment methods and digital transactions. Google Pay, deferred payment plans, credit cards, and many other forms of payment are compatible with tokenization and biometric identification.

The accessibility and convenience of digital payments will only increase over time. The applications of tokenization in the payment marketplace are growing quickly, and future developments in technology could apply this process to any number of electronic devices. Some day, a keyfob, a VR headset, or a screen on a spin bike could all become sources for safe, easy transactions.

Every organization needs to offer omnichannel payment options to meet customer demands, but convenience can’t come at the expense of security. Hackers will target any industry where money is moved, and the consequences of inadequate security could take years to repair.

Tokenization and biometric identification can help mitigate the effects of data breaches and payment fraud, while making digital payments more convenient along the way. However, to facilitate a more secure payment ecosystem, every organization needs to be on board.

—Tim Barnett is chief information officer at Bluefin