A Token of Appreciation

By Peter Lucas

Visa and Mastercard are acting fast to dominate the rapidly developing tokenization business. Are juicy fees next?

It’s been more than six months since Visa Inc. and Mastercard Inc. announced reciprocal access to one another’s tokenization engines. Pacts giving PayPal Holdings Inc. such access have emerged over the same period of time. And now the impact of those deals on the future of digital payments is finally coming into focus.

For Visa and Mastercard, reciprocity is more than just a fraud-prevention play. It is a multipronged strategy to broaden use of their digital wallets, extend access to their tokenization engines to third parties, and stake out a claim as the foremost token-service providers.

Individually, each of those objectives may not be a headline-grabber. But when viewed collectively, they are a strong indication Visa and Mastercard want the future direction of digital payments to run through them, and they want to profit from staking out that position.

By jockeying to become the premier token-service providers, Visa and Mastercard are making it harder for competitors to insert themselves between their brands, networks and card issuers, on the one hand, and digital transactions, on the other, payments experts say.

At the same time, the card networks’ deals with PayPal are a big first step toward making their tokenization engines more accessible to digital-wallet providers and device makers that support embedded card payments. In doing so, Visa and Mastercard have positioned themselves to provide the bulk of tokens needed to secure digital payments.

Should that come to pass, Visa and Mastercard will be in a stronger position to charge issuers for tokenization services, thereby creating a lucrative new revenue stream for themselves, payments experts say.

“Reciprocity is more than back-scratching between Visa and Mastercard. It can be extended to other wallet partners that will go to them, and not someone else, for a token,” says Richard K. Crone, chief executive at San Carlos, Calif.-based Crone Consulting LLC. “Visa and Mastercard are taking steps to ensure they won’t get passed by competing token-service providers and to be in position to charge issuers for providing tokens.”

A Recipe for Reciprocity

While Visa and Mastercard remain mum about the economics of reciprocity, the two networks agree that reciprocity will make it easier for merchants to accept payments initiated through their respective digital wallets, Visa Checkout and Masterpass.

Reciprocity will also make these wallets truly open payment platforms by requiring only one connection to either network’s tokenization engine.

With tokenization, wallet providers can protect cardholders by substituting randomized character strings for actual primary account numbers and other card credentials. Token service providers like the card networks keep track of these tokens and translate them into the actual card credentials when needed by issuers. They also provide the digital “vaults” that secure the unencrypted credentials (“Opening up the Club,” March, 2016).

Prior to reciprocity, a consumer could load Mastercard and Visa cards into a Masterpass wallet, for example, but Mastercard could tokenize only the Mastercard cards. The same was true of Visa, which could not tokenize Mastercard cards loaded into Visa Checkout.

This setup meant that when a consumer loaded a Visa card into a Masterpass wallet, the actual card credential was loaded.

With reciprocity, Visa and Mastercard can request tokenized payment credentials from one another for provisioning into Masterpass or Visa Checkout wallets. The networks began building out the infrastructure to support reciprocity this year and plan to launch the service on a region-by-region basis worldwide.

“Reciprocity ensures that Visa- and Mastercard-branded cards in a wallet can be tokenized, even if the wallet is a competitor’s product,” says Rick Oglesby, president of AZ Payments Group LLC.

‘An Explosion of Form Factors’

Reciprocity is expected to expand the adoption of Masterpass and Visa Checkout by creating a simpler, more secure environment in which to conduct digital payments.

Internet-enabled devices beyond smart phones and tablets are emerging, and providing tokens reciprocally for consumers initiating transactions using these devices is a key step for Visa and Mastercard, points out Zilvinas Bareisis, a London-based senior analyst for the financial-services consulting firm Celent.

In a blog posting from Dec. 15, 2016, James Anderson, executive vice president, digital-payment products for Mastercard, says that securing the new breed of Internet-enabled devices will be critical to the future growth of digital payments, and that Mastercard sees tokenization as the solution.

Anderson writes that, with some experts predicting digital payment may represent 20% to 30% of consumer payments by 2020, “core to this adoption is the reality that it’s not just laptops, tablets, and phones being used to make payments; rather, you’re seeing things like wearables and [Internet of Things] devices—including some household appliances like refrigerators—becoming payment devices as well. But what threads these and other recent digital-payment innovations together is the digitization and tokenization of card credentials.”

Visa and Mastercard view wearable devices, such as smart watches and fitness bands, as an opportunity to turn everyday devices into a new digital-payments platform (“Payments up Your Sleeve,” June, 2016). Token reciprocity strengthens their hand in striking partnerships with device makers to secure those devices.

“The way to deal with the complexity of devices coming into the market will be through partnerships,” Bareisis says. “Visa and Mastercard will provide the token, but the partner will provision it on their device because they understand best how to certify the device and have it securely interact with each payment endpoint.”

Those capabilities will be made possible for device makers by Visa and Mastercard providing access to the application programming interfaces for their tokenization engines. Access to those APIs will make it easier for device makers, merchants, and wallet providers that want to obtain a token for an e-commerce or mobile transaction to do so.

“As digital commerce expands, we are seeing an explosion of form factors,” says Vish Shastry, vice president, digital products, for Visa. “Reciprocity provides the framework to have a card credential safely embedded in a device without the risk of it being compromised if the wallet or device is compromised.”

To further enable interoperability between mobile-payment solutions, the card networks have begun striking partnerships with such digital-wallet providers as Android Pay and PayPal to allow consumers to use those wallets at Masterpass and Visa Checkout merchants. On its own, Mastercard has struck similar deals with Apple Pay, Microsoft Pay, and Samsung Pay.

“The deals the networks are cutting with Google [the company behind Android Pay], PayPal, and others lets those wallet providers use their existing tokenization programs in a copacetic way with the networks,” says Steve Mott, chief executive for digital-payments consultancy BetterBuyDesign, Stamford, Conn.

Reciprocity also opens the door to expanding the use of Masterpass and Visa Checkout by eliminating the need, and cost, for merchants to install separate connections to each network’s tokenization engine, or to make the choice of supporting one wallet over another, which can limit where consumers can use those wallets.

“Ubiquity is a critical element for shifting payments to a digital environment,” says Patricia Hewitt, chief executive of PG Research & Advisory Services LLC. “With reciprocity, Visa and Mastercard don’t have to concede the real estate at the point-of-sale around tokenization, since reciprocity makes it easier for merchants to run the transaction through them. Reciprocity is a lot like duality in that it creates ubiquity around the Visa and Mastercard networks.” Duality refers to the longstanding practice of U.S. financial institutions to issue cards for both Visa and Mastercard, rather than just one network exclusively.

Extending Reach

One of the key benefits to PayPal from its partnership with Visa and Mastercard is that consumers can now load both brands into their wallet to fund a purchase. As part of a similar deal with Discover, signed in January, PayPal will let eligible customers fund transactions with their Discover cashback bonus. Before, PayPal wallet users had to fund purchases using their checking account.

The network pacts also open the door for PayPal customers to use their wallet to make purchases at the physical point of sale, a service PayPal has sought to offer for years.

“These partnerships will allow consumers to use the PayPal Wallet to make in-store purchases at contactless-enabled merchant locations,” says Josh Goines, senior director, consumer choice and global business development, for PayPal. “These partnerships have extended the reach of our platform.”

Goines says the agreements do not mean that PayPal is looking to move its customers off of automated clearing house transactions in a bid to please the card networks, as some observers have surmised.

“These deals are about executing our strategy to expand PayPal’s reach at the point of sale, while offering merchants and consumers more choice,” Goines says. “We are focused on prioritizing choice and reducing friction on our platform.”

Fees Are Coming?

Ultimately, Visa’s and Mastercard’s moves toward reciprocity and partnering with competing wallet providers can be viewed as part of a strategy to build a ring around the digital-payments business, Hewitt says. Once that ring is firmly in place, Visa and Mastercard can begin charging issuers for tokenization services, she adds.

For now, no direct revenue will be generated from tokenization, says Pablo Cohan, vice president, product management, North America, for Mastercard. Instead, he says, the payoff will come from lower fraud and wider acceptance of Masterpass.

Although Visa’s Shastry declines to discuss potential revenues from tokenization, Visa has, at least for now, waived tokenization fees for issuers processing with Visa. The fees it reportedly had planned to levy included a 7-cent charge for each token and 2 cents for each decline. Visa started waiving tokenization fees in 2015.

But fees could well be coming, experts point out. “The money in tokenization comes from generating the token, provisioning and managing it,” says Tim Sloane, vice president of payment innovation at Mercator Advisory Group, a Maynard, Mass.-based consultancy. “If Visa and Mastercard can build homogeneity around tokenization in a fragmented market by replacing other token engines with their own, they can begin to charge issuers for their tokenization services.”

But competing token-service providers are unlikely to stand idly by and watch the card networks eat their lunch. The big question, card experts say, is how stiff the competition from other TSPs will be, as Visa and Mastercard have jumped out to a sizable early lead.

If nothing else, reciprocity between Visa and Mastercard, and their deals with PayPal and other wallet providers, have raised the table stakes for what token providers must offer, payment experts say.

“Reciprocity not only helps preserve the value of Visa and Mastercard’s franchises through fraud prevention, it positions them to be the go-to token providers for wallet providers, and gives them the first real product they can charge for in years,” Crone says.