EMV Payment Tokens

It is becoming ever important for merchants to understand the interchange categories for which their transactions are qualifying. In April, Visa further multiplied the categories for U.S. based merchants with the introduction of a nearly 0.10% bump for ‘Non-Tokenized’ transactions in many of the credit categories. For example, the credit Recurring Payments Interchange for MCCs 4814/4899 is 0.10% higher across the board for Non-Tokenized transactions:

A Visa statement couched their rate ‘increases’ as an event that merchants could simply avoid like a second helping of dessert,

‘…Any rate increases are largely avoidable and apply to transactions that are sent to Visa with insufficient data, are coded incorrectly, carry increased risk or are processed without using a Visa EMV payment token….’

Unfortunately, Interchange rates are complex and may not be fully available with every vendor or solution. Merchants need to be aware of the impacts these changes have on their bottom lines, however.

Separate but Unequal

This same 0.10% disparity exists for several other merchant categories. Merchants taking advantage of EMV tokenization will benefit but if, and only if, they are priced in a pass-through methodology which affords them the full benefit from the EMV tokenization. Understanding what EMV tokenization is and how it may be leveraged is critical for eCommerce merchants seeking to lessen their processing costs.

EMV vs Standard Tokens

First, it is important to understand that, for Visa, not all tokens are equal. An EMV token, like any token, replaces the primary account number or PAN with a payment token. An EMV token, however, is format preserving such that it may be interoperable with legacy processors and other providers within the payments stream (with the appropriate credentials). Unlike proprietary tokens, EMV tokens may be ported to a new vendor without the need for deciphering. Proprietary tokens have another flaw; they must be converted back to the primary account number for the card transaction to be completed. Regardless of the vendor, the EMV token need not be converted to the PAN at any point in the transaction. This is an enormous security advantage and one reason why Visa is providing preferential pricing to these types of transactions.

Additional Benefits

EMV tokens further bring value in that they may allow the issuer to restrict transactions by domain. For example, they may only be allowed at an eCommerce merchant or only with a specific level of authentication. This further reduces the value of hacked payment information as a payment token should not be able to be used beyond the environment in which it was intended.

Another benefit afforded merchants utilizing EMV tokens is they may utilize the Payment Account Reference (PAR) as a way to link transactions with the underlying card number or PAN. PAR has a one-to-one relationship with the PAN and a one-to-many relationship with the payment tokens. PAR data cannot independently be used to authorize a transaction and by itself, it is not considered PCI data. This is an enormous benefit as it allows the use of the PAR for customer identification while maintaining the PAN within the payment ecosystem. PAR must be used in conjunction with an EMV token. This enables support for value added services such as fraud screening and loyalty identification and support.

The PAR Data is made up of 29 characters and consists of a 4-character BIN Controller Identifier and a 25 character unique value which can be linked to the primary account number. The PAR can be linked to PAN and successor PANs which are generated due to card replacements from a loss/stolen event. The PAR may be used as follows:

  • As part of a payment transaction, by being populated as part of the authorization response;
  • As part of a payment transaction, by being passed from a payment device to a payment terminal, if the payment device has been provisioned with the payment token and the PAR and
  • Using a PAR inquiry service

From a merchant’s stand point, once the account number is tokenized, the cardholder does not need to re-enter their card number which will increase success rates. Issuer authorization rates too will increase in a virtuous cycle.

Conclusion

There are many vendors and solutions supporting EMV tokenization. Once tokenized (and unlike proprietary tokens) the PAN need never be exposed again. This standardization allows merchants to more easily port their recurring clients to a new vendor should they wish to do so and there is an enormous security advantage. Merchants should recognize the pricing disparity from processing tokenized transactions and combine that with an overall strategy to minimize their payment costs while increasing approval rates.

Author: Ken Musante, Commercial Director, San Francisco, Payments Consulting Network

***

If you enjoyed reading this article and would like to be notified when future articles are posted, please subscribe to our newsletter.