Amex Aims to Jump-Start Mobile Wallets in Tokenization Push

Tokenization, a security method that eliminates account data from exposure, is fast becoming linked to the advancement of mobile payments. American Express' latest service is designed to push both technologies along.

Amex anticipates that its new American Express Token Service, based on the tokenization standard established through EMVCo, the EMV standards body, will appeal to issuers and acquirers that are preparing to launch mobile products, said Mike Matan, head of global network business at American Express.

Amex also developed network specifications for Host Card Emulation, a cloud-based technology that allows contactless payments through an application, rather than through the secure element of a handset. Amex's HCE specifications provide additional security options for payments made with devices that support "KitKat," the current version of the Android operating system, Matan said.

"Things are looking positive for the development [of mobile payments] over the next few years and our feedback has been very positive," he added.

In the tokenization process, traditional card account numbers are replaced with unique tokens to be used for online, mobile or Near Field Communication transactions. The American Express service, available in the U.S. now and internationally in 2015, will also be used for any Amex transactions initiated through Apple Pay, Matan said.

Apple Inc. has touted its use of tokenization as one of several security features of its new mobile wallet.  It also uses tokenization for MasterCard and Visa accounts.  

"Tokenization through the card brands leverages the payments infrastructure and adds an extra level of security for transaction identification," said Al Pascual, senior analyst for Javelin Strategy & Research.

"The card brands are the linchpin in providing the extra value of tokenization in the transaction chain, but there are plenty of other tokenization services already being offered by third-party vendors," Pascual said.

In addition to EMVCo, the Secure Remote Payment Council and the Accredited Standards Committee X9 Inc. have been working on separate, but potentially complementary, tokenization standards.

The payments industry has not yet settled on a tokenization standard that all parties support, but the next year to 18 months will determine if a consensus can be reached, Pascual added.

"We may yet end up fragmented with some in-fighting, but if we get to where we should be, card data will be far more secure," Pascual said.

Some other services are set up to help individual merchant's unique cases, but American Express Token Service represents an end-to-end tokenization process, Matan said.

Matan could not provide any information on fees for the Amex service. MasterCard created a stir in the industry when revealing that it planned to charge "digital enablement fees" for the process of converting a personal account number to a token for payments from mobile devices.