Tokenization – the answer to secure real-time payments?

For many banks, account payment (ACH) fraud represents a bigger financial risk than card fraud. In particular, growing momentum for real-time payment schemes across the world is creating huge opportunities for fraudsters while placing increasing pressure on banks and clearing houses, which now have only seconds instead of days to identify fraudulent transactions.

There are various security approaches available to banks in the fight against fraud, but tokenization has already proved successful in protecting in-store and online card payments, with all the major payment systems, digital wallets and original equipment manufacturers adopting the technology.

By replacing unique sensitive information or data with a context-specific proxy, tokenization can significantly reduce the risk and impact of account-based fraud and foster safe, secure real-time payment initiatives across the world.

Tokenization – an extra layer of security

Financial institutions already deploy various techniques to prevent and mitigate ACH fraud. Banks coordinate with agencies such as OFAC (Office of Foreign Assets Control) in the US and OFSI (Office of Financial Sanctions Implementation) in the UK to share intelligence and monitor suspicious entities or actions.

At a more practical level, out of pattern activity identifies irregular or unusual transactions, transaction limits help prevent high-value fraud, and ACH block services aim to root out unauthorized senders and recipients.

But it is old-fashioned manual review the one that continues to be a mainstay of bank processes. According to a research from the Federal Reserve Bank of Minneapolis, 83% of banks in the US use this as a primary line of defence. This is simply not compatible with real-time payments and banks already recognize the inherent limitations even where it can be applied for slower ACH transactions, with 43% per cent admitting it was “somewhat effective or ineffective”.

Tokenization is not a silver bullet. Rather, it is a process that should be considered as complementary to all existing anti-fraud measures, adding another robust layer of security and bringing unique benefits.

Prepare for the worst, hope for the best

It is a hostile world, and for many organisations, data breaches are rather a case of ‘when’, than ‘if’. Payment account tokenization mitigates the impact of data breaches when they are attempted, as sensitive account information is not stored in its raw form. This reduces the risk of stolen account numbers being used to commit transactional fraud, for example.

Similarly, control parameters limit how tokens can be used. So, if a token can only be used to pay a monthly direct debit to a specific merchant, it cannot then be used to fraudulently perform several person-to-person transactions on the same day.

Importantly, as an underlying single account credential can have multiple tokens associated with it supporting specific use-cases, banks can tailor the controls and limits they wish to put in place. If one is compromised, it can be quickly and easily replaced without impacting the main account credential or other associated tokens.

Security, not disruption

Tokenization as a technology is suitable to support multiple payment use cases via a single system, ensuring emerging commercial models and the ability to adapt to new requirements that are not constrained by an inflexible security framework.

Also, tokens route normally through the payments systems and networks, so consumers and businesses can send and accept payments as usual, with no change in authorizations. Depending on the system and token usage, tokens can be formatted and validated in the same way as the original credential, allowing non-disruptive use in an existing ecosystem while enabling the swift onboarding of financial institutions’ members. Moreover, for new services, the token format can be simplified for frictionless use by the consumer.

For payment account tokenization to be effective, however, the infrastructure must be implemented at a systemic level. This means that Central Banks and Automated Clearing Houses have a crucial role to play in tokenizing the account numbers and managing the token vault - the centralized and highly secure server where they store the issued tokens and the account numbers they represent.

A new ecosystem… and new opportunities

The main aim of tokenization is to protect account credentials to increase security. There is an opportunity for banks, though, to take a wider view on the strategic use and potential of tokenization. Account-to-account based payment services, such as mobile payments and P2P, are increasingly popular, following the introduction of regulation such as PSD2. Banks can use tokenization as a means to build stronger trust with customers through the provision of ever-simpler and seamless account-to-account payments.

To learn more about real-time payments and how to secure them, download the Rambus eBook.

About David Worthington

With a career of over 25 years in Payments and Technology, David has worked for and consulted on smart technologies and technology migrations to banks, payment networks, Central Banks, technology suppliers. In addition, he has been involved in smartcard projects for health cards & ID. For the last 7 years with Rambus (formerly Bell ID), David has primarily focused on Mobile & Digital Payments and Tokenization. David has now moved in to a Strategic Business Development role, continuing to represent Rambus in numerous industry interactions, including EMVCo Technical Associates.

About Rambus

Dedicated to making data faster and safer, Rambus creates innovative hardware, software and services that drive technology advancements from the data center to the mobile edge. Our architecture licenses, IP cores, chips, software, and services span memory and interfaces, security, and emerging technologies to positively impact the modern world. We collaborate with the industry, partnering with leading chip and system designers, foundries, and service providers. Integrated into tens of billions of devices and systems, our products power and secure diverse applications, including Big Data, Internet of Things (IoT) security, mobile payments, and smart ticketing.