A startup tokenization-services vendor is seeking independent sales organizations to sell its security measure to merchants.
The supplier, Tulsa, Okla.-based TokenEx LLC, began operating a year ago and has signed up five merchants for its services, says Alex Pezold, the company’s CEO.
One of the merchants has installed the company’s tokenization service, and the other four should have it operational before the end of the year, Pezold tells ISO&Agent Weekly.
ISOs could collect upfront fees from selling or leasing tokenization hardware, but some merchants’ point-of-sale systems already support the service. Prospects appear better for ISOs to reap residuals from transaction fees, Pezold says.
At press time, no ISOs had made the commitment by join in the TokenEx enterprise, but talks were under way with some ISOs, Pezold says.
But the potential for ISO involvement seems real, says Adil Moussa, an analyst with the Boston-based Aite Group LLC. “A lot of companies have started to think about it,” he says of tokenization. “It’s not a bad space to play in.”
Tokens replace credit card numbers in transactions to protect the cardholders’ personal data from identity theft by computer hackers, Pezold says. Token values are assigned arbitrarily and bear no mathematical relationship to the original card number.
Unlike tokenization, encryption of card numbers, a service offered by other vendors, is based on using a mathematical formula to alter a card number, Pezold says.
That means a thief who steals an encrypted code number might work backward to secure the real card number, Pezold says. Because a token bears no mathematical relationship to the original card number, a criminal has no way to use it to determine the actual card number, he maintains.
If a merchant needs the original card number, TokenEx can provide it, Pezold says.
Merchants may use a new token for each transaction, but TokenEx prefers that they continue to use a customer’s same token for each purchase, he notes.
Reusing tokens poses no threat in brick-and-mortar stores because a hacker could not walk in with a token written down on a piece of paper and buy anything, Pezold says. The thief still would need a card, he adds.
Reuse poses only a minor threat online because each consumer has a different token for each merchant, thus greatly limiting the potential for fraud, Pezold contends.
“The tokens have little to no value for crimes,” he contends.
On the upside, reusing tokens enables TokenEx to offer merchants data on specific customers’ shopping habits they can use to sharpen their marketing and operations.
Unlike transaction processors that are teaming with software providers to offer tokenization, TokenEx concentrates on integrating its product with the merchants’ POS systems, Pezold says.
Merchants that break off the tokenization-services relationship with TokenEx can keep the tokens and thus avoid a possible interruption in customer service to their shoppers, he notes.
Because tokenization enhances security, it can reduce merchants’ cost to comply with Payment Card Industry data security standards, Pezold says. For example, websites do not “touch” the card numbers, so the number of questions is reduced on annual PCI certification questionnaires, he notes.
Tokenization guidelines the council released in August have contributed to a flurry of interest in the subject, Pezold observes.
As a result, merchants are beginning to see that tokenization can reduce costs, he says.
For example, TokenEx can lower processing fees, Pezold says. Whether the transactions originate on a dialup terminal, a mobile device or a call center, they all look the same to the processor after exposure to TokenEx, and merchants thus avoid processing penalty fees associated with some types of transactions, he says.
TokenEx can attach hardware that accepts its tokens to merchants’ point-of-sale systems, Pezold says. The company has the capability to make the devices itself and eventually may do so, he says. But for now it is offering other manufacturers’ equipment and is marking up the price only to cover the cost of handling and installation.
Meanwhile, POS equipment manufacturers are integrating tokenization capability into their systems, and TokenEx is meeting with some of them to offer its system for inclusion as standard equipment.
TokenEx is charging merchants transaction fees that decline with higher volume. In addition, maintenance fees of $2 to $3 per month cover equipment breakdowns and upgrades.
