Visa, Mastercard team up to fix the unbalanced security of e-payments

By making tokenization available on each other's digital wallets, Visa and Mastercard are addressing the security concerns of merchants who are happy to accept both brands but nervous about how their wallets can be misused.

Visa and Mastercard on Thursday morning announced an agreement that allows Visa to request tokenized Mastercard payment credentials from Mastercard for provisioning into Visa Checkout, and Mastercard to request credentials from Visa for provisioning into Masterpass.

Though the card networks have long allowed consumers to enroll with rival products, there wasn't an easy way to access those cards' card-not-present protections.

"Merchants have said it's great to provide tokenization, but have asked why the tokens are for just Visa cards and not for both card brands," said Vish Shastry, a vice president on the digital products team at Visa.

visa and mastercard cards
The logos of Mastercard Inc. and Visa Inc. sit on credit cards in this arranged photograph in Moscow, Russia, on Tuesday, April 1, 2014. Visa Inc. and MasterCard Inc. stopped processing cards for Bank Rossiya after the U.S. placed the lender on its sanctions list. Photographer: Andrey Rudakov/Bloomberg
Andrey Rudakov/Bloomberg

Visa Checkout debuted in 2014, designed to be a newer and more user-friendly replacement for the V.me wallet. The card brand has since entered into deals with Bank of America and other issuers to streamline enrollment. The story is similar for Masterpass, which debuted in 2013 and has also incrementally made usage easier, such as tying the Masterpass directly to bank digital wallets, a move that's proven successful in lifting adoption.

The deal is designed to ensure that each network's wallets can stay open to other card brands while adding tokens in place of real card numbers. Previously, each network's digital wallet accepted cards from the other network, but used the consumer's account number instead of the protective token.

"Banks can offer a wallet that supports all use cases in a way that's secure and has two different brands for the cardholder," said James Anderson, executive vice president of digital payment products for Mastercard. "This can help improve the quality of transactions and of the wallet."

The collaboration addresses the mainstreaming of e-commerce. This fall's holiday shopping season has already smashed records for digital payments — and for e-commerce fraud. There's also the growth of connected devices, the "Internet of things," card-linked offers and apps that make use of digitized card numbers—these can all benefit from more ubiquity in tokens.

The primary focus at the beginning of the cross-token acceptance will be on Visa Checkout's use as an e-commerce tool, which is where the majority of the payments volume is coming, Shastry said. "That's not to say we wouldn't take it in other directions in the future."

The card networks hope the deal will extend the proliferation of secure, digital payments, according to Visa's announcement.

"This is a clear move toward embedded payments," said Richard Crone, a payments consultant.

The winners from this deal are anybody who aggregates or embeds payments into their service, and that is "anybody with half a brain," Crone said, noting the examples include PayPal, Uber, Starbucks, Google, Samsung, Apple and retailer wallets.

"Card numbers aren't just card numbers anymore; they are the primary identifier of the customer in so many schemes. They are the identifier in a card-linked offer for example, or the ID for the authentication for Uber," Crone said. "It's a distribution play for [the networks] and an aggregation play for everybody else."

For reprint and licensing requests for this article, click here.
Cyber security Online payments Visa Mastercard
MORE FROM AMERICAN BANKER