Mastercard sees an opening for new data shields after the Equifax breach

Everyone's felt the chill of the massive Equifax breach, giving Mastercard a sense of urgency when detailing future security measures for its card network.

"Within the context of the Equifax breach, it creates a relentlessness that you have the basics of security down and you do all of it really well," said Johan Gerber, executive vice president security and decision products at Mastercard, noting that applies to prevention, detection, digital identity, and managing the balance between security and customer experience.

Mastercard detailed its security posture to investors this week in New York, referring to its strategy as one of "intelligent connectivity" aided by new innovation in machine learning and artificial intelligence. Consumers and merchants in a digital ecosystem are changing the way people interact with each other and machines. That is changing the way payments are completed, an evolution that will only expand in the future, Gerber said.

Andrew Harrer/Bloomberg

"No one is in control of this digital ecosystem, but it changes the way in which we will conduct commerce, so it is a big driver for us," Gerber said. Cybersecurity and digital identity become critical factors in this new ecosystem, as well as machine learning or artificial intelligence, he added.

To garner some control over a digital ecosystem, Mastercard has placed a priority on advancing biometrics beyond its Selfie Pay technology, acquiring NuData Security earlier this year. It was a move that fit Mastercard's strategy of strengthening device-level security as the Internet of Things and other connected digital commerce continues to grow.

In a similar move in July, Mastercard revealed its acquisition of Brighterion, a move that solidified the card brand's commitment to operating artificial intelligence throughout its network.

As it turns out, Equifax, one of the nation's largest credit bureaus, was not relentless at all in its security measures. The company admitted this week to not deploying a system patch that might have helped keep the most recent attack at bay.

"It is hard to say if there are thousands of instances like Equifax waiting to happen out there, but cybercrime and its threat are here to stay and it is getting stronger," Gerber said. "We see attacks against consumers and against financial institutions, and they are relentless."

Artificial intelligence is a core component of Mastercard's intention to connect the dots between consumers and devices.

"You need AI to really help you make sense of the data in terms of how consumers interact with their devices and how devices communicate with each other," Gerber said. "At any point in time, through AI, we have a view of every single transaction across the globe in real time."

Under that type of risk assessment, AI is able to screen the transactions, cite risky areas and automatically intervene to cut down on the risk.

"In the past, we had alarms going off, pagers going off and humans running in to try to deal with this, maybe with emergency emails," Gerber said. "What we have done now is have AI do it for us, so by the time we get on a phone to alert someone, AI has already shut down or mitigated much of the risk for us."

The proliferation of smartphones may make security more complex, but such a connected world is "a beautiful thing" in the eyes of Mastercard, Gerber said.

"We truly believe every device is a potential commerce device and that shouts opportunity in terms of turning cash into digital payments," Gerber added. "But it does raise risk, as every point becomes a vulnerable point in the eyes of criminals. That's where things like behavioral biometrics — how you type on the phone and how you hold the phone — comes into play."

The same type of scrutiny will hold true, not matter what the payment form in the future may become in a digital commerce.

While not condemning bitcoin and other cryptocurrency in the same manner as JPMorgan Chase CEO Jamie Dimon did earlier this month in declaring it a "fraud," Gerber did indicate that Mastercard feels merchants, consumers and investors alike should be aware of its potential security pitfalls.

"Some have this perception that cryptocurrency provides a level of safety and security that normal payments cannot provide, and this is simply not true," Gerber said. "They are susceptible to the same cyber risks and identity theft. Investors really need to have a handle on that."

In the immediate future, consumers are going to see more biometrics come into play, particularly with Apple now deploying Facial ID in the new iPhone X.

Mastercard has been testing biometric payment cards in South Africa with positive results, Gerber said. "Some of our banks are looking forward to this coming into play for their affluent portfolios, and we will see the cost of these products come down with scale."

The payments security industry is finding itself in an "arms race" with cybercriminals, Gerber said, and ultimately the answer is not so much to continue to build stronger security, but more along the lines of finding ways to render the data useless once it is in the hands of criminals.