No more updating card details: Visa rolls out tokens online

New digital payments technology from Visa is set to significantly reduce ecommerce fraud, while removing a major consumer pain point – updating your details online every time you get a new card.

The technology, called credential-on-file (COF) tokenisation, means that card details such as the 16-digit account numbers and expiry dates will no longer be stored online when consumers make a purchase. Instead, COF removes sensitive information from merchants’ systems and replaces it with a token, which is meaningless if stolen by fraudsters.

Visa’s head of digital product and partnerships for Australia, New Zealand and the South Pacific, Matt Wood, told The Australian Financial Review the tokens would be linked directly to a consumer’s card, so even if it gets lost or stolen and a new one needs to be issued, the consumer will not need to change their details when shopping online, nor update direct debit details.

„We see this as a foundational step for the future of innovation in payments,” he said.

„Like in a physical retail environment where they rely on point-of-sale systems providers to take payments, the same situation exists in ecommerce. Gateway providers give connectivity to the payments ecosystem and also provide the security in terms of protecting card numbers. With tokenisation, the gateways will integrate directly into Visa’s token services.

„If there’s a hack or a breach that takes place, what’s harvested will be effectively worthless.”

Tokenisation
The technology is the same as what’s already being used in the physical world with services like Apple Pay or Samsung Pay, where a person’s phone is linked to their card.

From Tuesday, Visa will start rolling out tokenisation for ecommerce transactions, having formed partnerships with payments gateways and innovators such as CyberSource, Adyen, Rambus, G+D Mobile Security, SecureCo, Ezidebit, eWAY and Bambora, according to Financial Review.

Thanks to these partnerships, which Mr Wood said covered the bulk of local digital transactions, merchants will not have to make any changes to their own systems to enable tokenisation.

„Digital commerce is facilitated by an ecosystem of different businesses with different roles,” he said.

„Our initial tokenisation partners are a mix of Australian and international payment companies and they process a significant share of digital payments in Australia. We’ll look to bring on more partners over time, but this is really substantial.”

The invention of chip technology has been effective in lowering in-person card fraud and has resulted in criminals shifting their efforts online.

Growing fraud
AusPayNet figures for 2017 revealed that card fraud jumped 5 per cent in 2017 to $561 million, with card-not-present fraud making up 85 per cent of all the cases.

With online fraud now making up such a large portion of all card fraud, in August AusPayNet released a mitigation framework to help the sector tackle the problem.

Under this proposed framework, merchants who record fraud rates above an industry benchmark would be required to us multi-factor authentication, except for low-risk transactions. It also set out plans to boost the use of tokenisation and encouraged the use of biometrics in authentication card-not-present transactions.

Mr Wood said this was the start of a new phase of innovation, believing that within two years consumers would also be able to update their payments details across all ecommerce websites and utilities companies from their banking app in just a few clicks.

„You’ll be able to log into your banking app and push your details to all merchants that can process tokens,” he said.

„You’ll be able to manage all the places your payment details are stored, giving you control over your payment details in a way you’ve never had before.”