Networks Say SRC Will Go Live Later This Year to Simplify—And Secure—Digital Checkouts

A standards body controlled by the major card networks released on Friday a long-awaited standard aimed at simplifying and securing consumer checkouts on the Web and in apps.

By mid-morning, American Express Co., Discover Financial Services, and Mastercard Inc. had announced they intend to implement the spec later this year. Visa Inc., which also has been working on the spec, is also expected to adopt it. Mastercard says it will launch the standard late in the third quarter.

The EMV Secure Remote Commerce Specification v1.0, as it’s formally known, comes from the international payments-standards body EMVCo and is aimed at decluttering online checkouts by mimicking the cardholder experience at a physical terminal inside a store. The aim is to allow consumers shopping on an e-commerce site, for example, to pay for purchases with a single click on a single button.

The new standard is also seen as a new weapon in combatting fraud, which ballooned in online markets after the rollout of EMV chip card payments tightened security at point-of-sale terminals in U.S. stores. Mastercard for its part says it will combine its SRC launch with access for merchants to machine-learning tools from NuData, an anti-fraud technology company the card network acquired in 2017.

The networks’ SRC announcements June 7 are “part of a continuing quest to not only continue with e-commerce fraud-fighting efforts, but also to demonstrate their continued efforts to merchants, especially the small- business tier,” says Raymond Pucci, director of the merchant-services practice at Mercator Advisory Group, a Maynard, Mass.-based consulting firm, by email. “As with other payments standards in recent years, it will take a while to see how this turns out.”

The standard, which has been in development for more than a year, controls only the so-called front-end of a digital environment, notes Pablo Cohan, Mastercard’s senior vice president for digital payments in North America. “All the back end remains the same,” he says. “It’s about how the consumer is interacting with the Web site.”

According to the spec, the shopper who is ready to check out will click the SRC button to enter an email address. That action will bring up a list of cards she owns, regardless of network brand. She then selects one to complete the purchase. First-time SRC users follow a guest-checkout routine by entering their card details and billing address. They also will be asked if they want to create an account.

But merchant spokespeople are concerned this process will prove off-putting to new users, leading to more abandoned carts, says Laura Townsend, senior vice president of operations at the Merchant Advisory Group, a research and advocacy organization for merchants regarding payments matters. “It’s a clunky customer experience,” she notes, though she says this will affect mainly small retailers. Larger ones, she says, have already worked out their own checkout solutions. “We don’t see large merchants adopting SRC,” she adds.

Another lingering concern, Townsend says, has to do with how SRC could affect the transaction-routing choices merchants were granted under the Durbin Amendment. The MAG argues that under SRC the network will return to the merchant a detokenized primary account number “but not all the security elements behind the transaction” that could be needed for routing, Townsend says.

Mastercard’s Cohan says the network has been “getting feedback from merchant groups like the MAG.” He argues network choice has been preserved for merchants under the standard. “I know there’s been confusion, but that choice remains there,” he says.

Townsend says the MAG, for its part, has been in conversations with the networks and has narrowed its concerns. Large merchants may shun SRC, but “smaller merchants will benefit,” she concedes.

Indeed, however the rollout of SRC affects card issuers, merchants, and the payment networks, observers say the result should be a net benefit. “Merchants continue to have a degree of skepticism about changes that may impact their sales,” says Mercator’s Pucci. “But if the security enhancements take a big bite out of fraud, as intended, then merchants and their customers will have no complaints.”