Choosing the Right Tokenization Scheme - The Merchant Conundrum
For merchants to provide consumers with the ability to pay with their phones, it means having a NFC-ready POS terminal with NFC turned on. Consistent, comparable statistics on the NFC-ready device install base are difficult to find, but most percentage estimates hover in the single digits.
Recognizing that NFC terminal rollouts will take some time, Samsung’s approach does not simply support NFC, but also can deliver payment tokens to existing magnetic stripe readers. Samsung acquired LoopPay and its Magnetic Secure Transmission (MST) technology. MST mimics a magnetic stripe swipe by passing magnetic pulses from the mobile phone to the card reader. While not 100% compatible with magnetic stripe readers, MST can be used at 90% of U.S. merchants that use mag strip technology at their POS terminals. The merchants needn’t upgrade their terminals, as they must do if they choose to support NFC.
Other products such as Coin, FiTeq, Stratos, Swyp and Wocket support a programmable magnetic stripe so that a consumer can consolidate multiple cards onto a single card. Because of the dynamic aspect of these products, the possibility exists that their services can be extended to provide tokenized track data in a manner similar to LoopPay. While these cards can be used at most POS terminals, the lack of adoption suggests that consumers are not ready to pay for this privilege by purchasing these products, which can cost upwards of $100 per year.
Mobile QR codes (mobile QRC) can be used to facilitate payment token exchange in emerging acceptance environments. However, overall enthusiasm is somewhat muted by the fact that EMVCo does not currently specify a QR code solution. Once sanctioned, it is expected that the QR code would include a token cryptogram to protect against reuse and be one-time use or have limited life.
Finally, there’s the merchant’s conundrum about which, if any, of the delivery methods to support. Gone are the days of the old zipzap embossing devices, but magnetic stripe reader-based POS terminals still reign supreme in the U.S. Merchants typically do not invest in new POS technology unless there is a compelling reason, such as the threat of the liability shift last October, access to a desirable special customer segment (e.g., with the ApplePay frenzy of yesteryear) or widespread demand. With the adoption of the EMV standard in the U.S., retailers must upgrade their devices at the POS to accept chip-enabled cards. The problem is determining what should replace that old Verifone Zon JR. What acceptance technology will the merchant need in the next three to five years?
This is a difficult challenge since POS terminal vendors don’t have a crystal ball either and have been hedging their bets. Many have introduced the Swiss Army knife equivalent of a POS terminal in an effort to support the full range of technologies in play. Poynt, for example, is offering a supposedly future-proof terminal that has a hybrid EMV/mag stripe card reader, QR/barcode camera, NFC antenna and Bluetooth antenna.
So, what can we conclude from all of this? The change to the payment ecosystem will be gradual but is inevitable. With every transaction that migrates to payment tokens, the scope of data breaches will be reduced. But just as the migration from check to magnetic stripe card did not happen overnight, the switch to payment tokens will take time. The EMVCo tokenization framework focused the industry’s mindset. Apple Pay amplified the momentum several fold. Google is attempting to do the same thing with Android Pay. Consumers, it seems, may still not be convinced.
Meanwhile, we have seen a spat of other emerging mobile technologies appear on the landscape, including wearables, embeddables and driveables. Many of these innovative products include payment capabilities, making navigation of this turbulent sea even more of a challenge for companies and their customers. If the digital revolution has taught us anything, it is that wherever the ship of digital payments makes port, it will not be the big tech companies, banks, credit unions, retailers and FinTech suppliers who chart the course. It will be Joan and Joe Main Street, who will weigh their options and choose the answer that best suits their needs for security, control, choice and convenience and then sail for home.