Tokenization Now Seen by Merchants as Performance Optimization Play

Jeff Hallenbeck, head of payments at Forter, said tokenization, from the merchant point of view, is moving from being thought of as an operational cost to an opportunity to drive revenues.

Tokenization — the act of replacing sensitive data with randomly generated, encrypted surrogate values, or tokens — traces its genesis and momentum more than a decade ago amid several high-profile data breaches.

“The dark web,” he said, was in search of sensitive data “and was winning the battle in terms of getting that data and using it for bad purposes.”

Back then, tokenization was focused on card security, a PCI compliance play that consisted of merchants establishing their payments vaults and moving the card details into that vault, he said.

What’s Changing

Fast forward to the present day, and, as Hallenbeck said, many merchants are looking toward ways to drive value and reduce costs.

Asked why tokenization may yet have some headwinds in place, at least for more widespread adoption, Hallenbeck said there’s still some complexity in the mix, as providers must consider how many times to update cards and must have data science and product engineering teams in place. There are storage costs to consider too.

“That’s why we’re seeing merchants outsource and saying, ‘Look, you can take on this complexity for me,’” he said.

Outsourcing those efforts can take one of two paths, he said. A merchant might seek to tokenize card data through their payment processor. Elsewhere, a mid-sized to large enterprise might choose to undertake its own vaulting activities or externalize its efforts to a third-party provider such as Forter. Strategy comes down to merchants mulling whether they want to send payments across several processors or whether they’ll be sending tokens over a network token rail versus a standard credit card rail or pinless debit.

“All of these choices come into play when you have what I call an agnostic token strategy … and where a token can be decrypted and sent wherever it needs to end up but still can keep merchants safe from a security and compliance standpoint,” Hallenbeck said.

Against that backdrop, the agnostic strategy is becoming ever more important as merchants boost their defenses against fraudsters and improve the customer-facing experience, he said. Tokenization keeps card data fresh and can prove especially valuable with subscription business models, as recurring payments take place uninterrupted via the vaulting process.

“It’s seamless and a great customer experience,” said Hallenbeck, as tokenization reduces churn, which in turn reduces merchant costs while driving loyalty and revenues.

Looking ahead, he said, issuers are likely to embrace tokenization strategies more fully, driving connected commerce between the issuers and merchants. Tokenized card credentials can be automatically populated into accounts so that consumers can shop with the ease of one-click checkout. Merchants are centralizing their services as they seek to streamline interactions with multiple processes and other providers in an orchestrated payments environment as they get “smarter” and proactive about using data and models to optimize costs and operations.

“The industry is shifting toward viewing tokenization and card vaulting as a performance optimization play,” said Hallenbeck.