Digital Transactions Authoritative, insightful and timely information for payments professionals
Merchant groups and payment-industry members both want to use tokenization to make it tougher for criminals to get to sensitive cardholder data, but a disagreement has erupted about the best way to do that.
On Monday, the Food Marketing Institute, Merchant Advisory Group, National Association of Convenience Stores, National Grocers Association, National Restaurant Association, National Retail Federation, and the Retail Industry Leaders Association issued a statement calling for an open and universal tokenization standard.
Tokenization replaces the actual card data needed for a transaction with a randomly generated digital code.
The merchants “strongly encourage” payment stakeholders to incorporate a standards-setting body into their efforts to build a tokenization standard.
Similarly, the Secure Remote Payments Council, whose members include large debit networks, issued a plea last week for an open approach to tokenization. “Standards must be open, enabling all to compete equally,” a press release stated.
Several payment organizations have tokenization efforts under way.
Last week Visa Inc. said tokenization is central to its new Cloud Payment Solutions suite of services. EMVCo, the international standards body for chip cards using the EMV specification, has developed a tokenization specification. EMVCo is owned by card brands American Express Co., Discover Financial Services, MasterCard Inc., UnionPay, and Visa Inc. And The Clearing House Payments Co. LLC said earlier this year that it is exploring a tokenization scheme for automated clearing house transactions. The Clearing House is owned by 22 financial institutions.
Neither The Clearing House nor EMVCo commented on the merchants’ statement.
Bank and card-brand ownership of groups developing token specifications or implementing token services is the merchant groups’ concern. The merchant groups want payment-industry companies to create a technology-neutral platform for tokenization that is part of recognized standards bodies, such as the International Organization for Standardization and the American National Standards Institute.
“An open, interoperable platform will also ensure merchants can support the technology across multiple providers and make back-end security processes seamless for the customer experience,” the groups’ statement says.
“The merchant community is concerned about the migration of important technical standards regarding payments from an open standardized environment to one that is exclusively controlled by the prominent payment brands,” Mark A. Horwedel, chief executive of the Merchant Advisory Group, tells Digital Transactions News. Already, he says, two major pieces of payments security—the EMV chip card standard and the PCI Security Standards Council—are controlled by the card brands. Now, a third piece, tokenization, is set to follow suit, he says.
As the U.S. payment system moves from magnetic-stripe cards to those using EMV, it is going from an open environment to a proprietary environment, Horwedel says. The International Organization for Standardization sets magnetic-stripe card specifications.
Card-brand payment networks should not be in charge of tokenization since not all point-of-sale transactions involve a card brand, Horwedel says. He cites transactions made using SNAP, the food-stamp program known as the Supplemental Nutrition Assistance Program. Those payments are made using the automated clearing house system. “Why should all of these use cases, many of which don’t involve the proprietary card brands, fall under their control?” he says.
