Tokenization Plays the Central Role in Visa’s New Cloud Payment Suite

Visa Inc. moved on Thursday to commercialize mobile payments using cloud-based near-field communication technology with its release of Visa Cloud Payment Solutions. A related development, the announcement of the upcoming debut of a tokenization service, is aimed at locking down cloud-based NFC and other digital payments.

The new services include support for new payment methods, such as a software development kit to enable developers to embed Visa’s contactless PayWave technology into their applications; Quick Response code payments; and Visa Checkout, its revamped online wallet service. The suite also includes Visa’s new host card emulation technology for enabling NFC transactions without using a hardware-based secure element.

And available in September will be a tokenization service that enables financial institutions to substitute a random digital token for the 16-digit card number. “It essentially allows financial Institutions to issue digital accounts that can be used to process online payments and transactions initiated with mobile devices,” Jim McCarthy, Visa senior vice president of innovation and strategic partnerships, says in an email. “The service will be offered to issuing institutions as an ‘on-behalf’ service.” Visa says the commercial framework for the service will not be released publicly.

Visa’s token service can support token creation for all product types, not just Visa-branded cards, McCarthy says, which a consumer may have stored in his Visa Checkout account. The tokens can be stored on mobile devices, e-commerce applications, and in cloud-based mobile applications. Tokens can be limited to use with specific merchants, mobile devices, or types of purchases, Visa says.

These services will aim to increase the security of payment across many types of devices that have Internet connectivity, such as smart phones, tablets, desktop computers and wearable products, like watches.

Besides software developers, programmers also can use the new services in apps, McCarthy says.

Visa Cloud Payment Solutions is necessary because of the shift from plastic to digital, McCarthy says. “New technologies, in particular mobile, have had a profound impact, shaping the way we shop, pay and get paid—not just here in the United States, but globally,” he says. “As the payments industry shifts from plastic to digital, we are supporting our clients to offer consumers a safe, simple and consistent purchasing experience, regardless of where they are and what device they are using.”

Visa says many of the services are available now with the full suite expected to be available in the United States by January.

Industry observers expect other card brands to follow. “There is a significant addressable market in the space and the card brands are best suited to offer products and peace of mind regarding security,” says Jason Peaslee, managing partner at Thrive Analytics LLC, a Kettering, Ohio-based consultancy. “In light of the ongoing data breaches happening at the store level, this is a natural step.” In a recent Thrive Analytics study, consumers ranked security concerns as the top barrier to using a digital wallet.

“Based on the findings of our digital wallet study it is quite evident that awareness is not the main issue impacting usage—it is security,” Peaslee says. “Visa likely recognizes this as a main barrier to adoption so is capitalizing on the latest release of Visa Cloud payments to address the gap.”

Making it easier for consumers to make, and merchants to securely accept, payments in the digital environment, is necessary, says Rick Oglesby, senior analyst at Double Diamond Group, a Centennial, Colo.-based consulting firm. That’s especially important for Visa to maintain its market position, he suggests.

“One of Visa’s main strengths is it’s availability around the world,” Oglesby says. “Historically, gaining merchant penetration has been very difficult, so it’s been nearly impossible to launch a new payment network. However, as payment methods change and more infrastructure moves to the cloud, it will get much easier for competitors to gain a foothold.

“If Visa and the other networks move now to keep their merchant-facing services competitive and to ensure that their services are extremely easy to use, then they can maintain their competitive position,” Oglesby says. “However if they do nothing then a bunch of other companies will pop up to fill any open gaps, which could erode the position of the networks over the longer term.”

Visa is smart to roll out a mobile-payments tokenization strategy now, says Nathalie Reinelt, an analyst at Boston-based Aite Group LLC. “Mobile payments is still in its infancy and Visa’s Digital Solutions—alongside their support for a remote secure element in the cloud—will establish a secure standard early enough in the evolution of mobile payments to ensure a smooth integration,” she says in an email.

“Mobile payment security is top of mind right now for merchants when it comes to enabling mobile point-of-sale commerce, but running a close second is the migration to EMV chip cards, which will push counterfeit fraud away from brick and mortar merchants and directly to their online platforms,” she says. “Fraudsters will be on the hunt for credit card data they can exploit online and tokenization will support the risk management community’s efforts in mitigating their card-not-present fraud losses, which Aite Group is projecting to double by 2018 due to the EMV migration.”

Both issuers and merchants face an October 2015 deadline from the major card networks to be prepared for EMV, a 20-year-old chip card standard already well established in the rest of the developed world. By that date, liability for counterfeit card fraud will shift to the party not equipped for EMV.

Visa’s McCarthy says the token service is based on existing standards and aligned with EMV technology. “Tokens issued through the Visa service are designed to be processed and routed by all participants in the payments ecosystem in the same way traditional card payments are processed today,” he says. “But unlike traditional card payments, tokens can be restricted in how they are used with a specific merchant, device, transaction or category of transaction.”