Visa Launches a Service Aimed at Stopping Fraud Caused by Illegitimate Token Requests

Tokenized credentials are supposed to stop fraud by masking card account numbers when a transaction is processed, but according to Visa Inc. global losses owing to illegitimate tokens totaled $450 million last year. That’s bad enough to prompt the network to announce early Wednesday it is launching Visa Provisioning Intelligence, a service aimed at combatting token requests from fraudsters.

The new service, which relies on machine learning to rate the probability that a token request is fraudulent, comes as the widespread adoption of the EMV standard has led criminals to sidestep the standard’s obstacles by submitting bogus token requests. With legitimate requests, the card network converts a given account number into a so-called hash that enables the transaction to proceed but would be useless to criminals if stolen.  “However, tokens may be illegitimately provisioned to bad actors,” Visa says in its announcement of the new service.

Tokenization is a process typically handled by a third party, such as a merchant processor, or directly at the point-of-sale terminal, in the case of an in-store transaction. The technology in recent years has become increasingly common. “It’s rare at this point where a [client merchant] is sending raw card numbers all the way to Visa,” notes Cliff Gray, a senior analyst at TSG, a payments advisory.

Tactics employed by fraudsters to obtain tokens for fake transactions include social engineering, typically schemes in which criminals impersonate what otherwise appear to be legitimate merchants. The new service uses a scoring routine ranging from 1 to 99 to indicate the likelihood of fraud, with 99 standing for the highest probability.

Machine learning models use scans of previous good and bad requests to isolate patterns that would indicate the probability of fraudulent intent, Visa says. That probability then results in the final score. In all, the intent is to stop a fraudulent transaction before it can occur, the network says.

Visa says the new service is available globally.