TOKENIZATION TRIUMPHS AND TRIALS: A RECAP OF MRC'S EXPERT-LED TOKENIZATION VIRTUAL SUMMIT

Here at MRC, we recently held our latest Tokenization Summit, our expert-led, multi-track deep-dive virtual event with keynotes, speakers, and panels sharing their wisdom on all things tokenization. 

Why? Because it is one of the topics that keeps coming up in conversations with everyone in our ecosystem from merchants to providers to law enforcement.  

Also, because it is a complex and important topic for our members and all payments professionals.  

As the payments landscape continues to evolve, tokenization has emerged as a solution to enhance security and protect the sensitive payment information that fraudsters value.  

Something that thwarts fraud? Sign me up! Tokens for everyone!  

Except even the best ideas that look like silver bullets come with unintended challenges and lessons learned. And tokenization is no exception.  

Here are some of the notable highlights we heard during the summit: 

Large Merchants Holding onto PANs 

"But wait, this blog is about tokenization," you might say. Yes, it is. However, let’s remember that protecting revenue isn’t just about encrypting data. It is a balance of risks as solutions mature. Despite the push towards tokenization, a prevailing trend among large merchants is the retention of the Primary Account Number (PAN). Merchants cite reasons such as inconsistent results around authorization while using tokens, retry strategy testing, or cautious concerns around impact to other legacy processes. The general hope is that PAN will not be needed as a data element someday, but today is not that day.  

Token First, PAN Fallback 

As a best practice, many merchants are embracing a ‘Token First, PAN Fallback” approach in an attempt to take advantage of the benefits of tokens. Whether implementing tokens completely in-house or by leveraging the partnership with payment solution providers (PSP), merchants mentioned key data learnings to consider. The quality and consistency of tokenization implementation is still maturing across the industry. With PSPs, many are differentiating their offerings with key intelligence features like retry and routing logic to optimize authorization and costs.  

Some issuers have implemented tokens and their lifecycle management so well that seeing a four percent increase to authorization rate is attainable. Monitoring the results by issuer can lead to optimizations whereas other suboptimal implementations can make it where the PAN outperforms the token. For merchants holding the PAN, it allows them to save customers – thus protecting revenue. But then you will likely pay twice – once for the token, and once for the PAN – which brings us to the topic of costs. 

ROI Calculation: A Daunting Task 

Tokenization introduces a complex web of factors that make return on investment (ROI) calculations challenging. To accurately gauge the benefits, merchants must consider liability shifts, new fee structures, acceptance rates, and customer service costs. When you layer in retry strategies, fees for issuance, updates, use or even not using the token, calculating the true cost can turn into a math exercise that pushes data nerds to the brink.  

However, to bring you back from the brink, there is a whole session in this summit on just the topic of ROI including formulas and considerations as you determine the true cost of ownership of tokenization on the bottom line. Understanding where all the fees exist is paramount to navigating the strategy of tokenization implementation.  

Unintended Consequences and Process Breakdowns 

Tokenization, despite its security benefits, brings about unintended consequences. The reliance on Bank Identification Numbers (BIN) for card type identification has been impacted (though in fairness, not just from tokens). Virtual cards, prepaid cards, tokens and implementation inconsistency have complicated the reliability of BIN and its use by merchants. Law enforcement case building has also been impacted because the intelligence that was known with the BIN is now muddied by tokens and adds time and complexity for case prosecution. Fraud schemes can become more complicated in the case of device tokens as customers upgrade phones. Customer service processes are impacted with things as simple as the last digit-digit card number intelligence because the token doesn’t reflect the actual card number, making it difficult for the customer and the merchant to resolve return issues. 

Summary 

Regardless of where you are on your journey, tokenization is here to stay. It adds value today and will add more value to the ecosystem as the consistency of implementation and knowledge matures. All of this ultimately adds value to the customer. Navigating the journey for your organization can be enhanced through sessions like this one and collaborations with industry peers. 

If you missed the summit, all the summit sessions will be available to MRC Members in our Resource Center.  

 

Note: If you are just starting on your tokenization journey, this summit did include an introductory session explaining tokens. For a limited time, all registrants will receive a 20% discount on the purchase of our accredited e-learning course for Tokenization 101.