One token to bind them all

I recently read an article in Digital Transactions titled “Billions of Tokens,” which discusses significant tokenization milestones achieved by Visa and Mastercard. Visa’s network token volume is increasing by 40% annually, reaching an impressive 12.6 billion tokens. Similarly, Mastercard now processes approximately 1 billion network tokens each week. 

In recent years, tokenization has become increasingly prevalent. The article suggests that credit card payments may soon be fully tokenized. Since PCI DSS requires storing primary account numbers (PAN) in a manner that cannot be reverse-engineered, all participants in the payments ecosystem might utilize a payment token (surrogate value for PAN) during transactions.

Processors, gateways, acquirers, networks, and mobile devices utilize payment tokens. So how do merchants manage them all? Merchants need a tokenization strategy or at least to standardize on a single source. 

Merchants who utilize a simplified payment processing approach with a single provider should ideally use the token provided by their processor, acquirer, or gateway for each transaction. Merchants need to ensure two key aspects: the tokens should be format-preserving (maintaining 16 digits, with the additional benefit of having the last four digits unmasked), and the processor should be able to associate these tokens with network tokens. This association can enhance acceptance rates, reduce costs, and mitigate fraud.

The primary challenge with this strategy is vendor lock-in, as these tokens will proliferate throughout the merchant’s connected ecosystem, if they operate omnichannel services, maintain a loyalty program, or have closely tied partners.
Given that a token’s greatest value lies in its function as unique secure shareable database keys, merchants must share them effectively.

Merchants using multiple acquirers may need to manage various tokens for the same customer/PAN, ensuring accurate identification of the originating acquirer. This complexity highlights the need for a strong tokenization strategy.

The title of this blog, “One token to bind them all,” refers to the concept of an omni-token. This omni-token is a single representation of a customer’s credit card that can be associated with any other token the merchant receives back or needs to utilize. Unlike the ring in Tolkien’s Lord of the Rings trilogy, which makes its holder powerful, the omni-token is intended to be used beneficially.  

Networks strongly support the tokenization strategy, providing discount points on transactions that utilize them. Additionally, network tokens enhance the payments process, reducing transaction fees and improving authorization rates. Merchants can save up to 20% on transaction fees and decrease fraud-related losses by 15%.¹ Understanding network tokens is crucial. Here’s an example: an omni-token referencing a network token. The payment processor has already provisioned and stored the network token in the token vault, linking it to the merchant’s omni-token. 

The straightforward answer is that not every transaction is processed directly via a credit card like alternative payments. Transactions can also be completed using services like PayPal, Click to Pay, Apple Pay, Google Pay, or any of the numerous digital and mobile wallets that consumers worldwide currently utilize — all of which employ tokenization to protect customers’ credit card or bank account numbers.

Furthermore, a network token is generated for a specific combination of card and requester. If the requester is the payment processor rather than the merchant, the merchant can only use the network token through that processor. This limitation may reduce flexibility and potentially affect the effectiveness of your tokenization strategy moving forward.

Tokens are unique and securely shareable with internal and external systems (partners). This capability enables previously isolated systems to integrate within a payments orchestration system, thereby reducing latency. This reduction is critical for BOPIS, BORIS, and loyalty programs in omni-commerce environments.

For example, if an individual cancels an in-store pick-up transaction on their phone while the employee retrieves the item from the back, any system latency could allow the individual to leave without detection, resulting in a loss for the merchant.

Tokens can help with:

• Joining siloed systems
  Since the omni-token is secure, it can be shared and utilized as the primary or foreign key field to establish a relationship between databases without bringing that linked system into PCI scope.
• Enhanced data insights: By analyzing transactions involving multiple tokens, merchants can gain deeper insights into customer behavior, preferences, and purchasing patterns. This information can be used to optimize marketing strategies and improve product offerings.
• Personalized offers: Linked tokens enable merchants to create offers and rewards based on comprehensive customer data, enhancing engagement and loyalty.
• Enhanced customer experiences: Integrating payment tokens with other tokens provides customers a seamless experience across various services and platforms. For example, loyalty points can be automatically applied during checkout, enhancing convenience.
• Securing PII: The omni-token can be associated with additional PII or cardholder data.

One omni-token can link everything together by providing a unified tokenization strategy that integrates with various networks, acquirers, and PSPs. This approach ensures that merchants have control over their tokenization process, allowing them to leverage the benefits of network tokens while maintaining interoperability, and security. By using a single omni-token, businesses can simplify their payment processes, reduce costs, and enhance the overall consumer experience.

To discover more about the different types of tokens a merchant is receiving and how merchants can retain control and flexibility read Omni-Commerce Is Heating Up the Merchant Token Revolution Additionally, you can learn more about tokenization, network tokens, and omni-tokens with ACI’s comprehensive blogs and guides.

_{1 https://usa.visa.com/content/dam/VCOM/global/products/documents/visa-token-service-factsheet.pdf}

ACI’s tokenization solution reduces compliance burdens, gives customers the security they demand, and easily integrates into your current payments system.