Digital Payments - Netcetera Innovation Summit 2018
1 like608 views
The document discusses the importance of tokenization and secure remote commerce in digital payments, highlighting the security risks associated with card data storage and fraud. It outlines the framework of token requests, service providers, and the roles of various entities in ensuring safe transactions, particularly in mobile and e-commerce payments. Additionally, it introduces the Secure Remote Commerce (SRC) initiative aimed at improving interoperability and security in online payments starting from 2019/2020.
Digital Payments - Netcetera Innovation Summit 2018
- 1. Bernried, September 2018 Kurt Schmid, Managing Director Digital Payments A small step for a programmer, a big step for payments Merchant Tokenization & Secure Remote Commerce
- 2. Questions Who likes to enter PANs again and again for every new merchant? Who is worried of fraud on his/her card? Who knows all the places where your card data is stored? Why is Amazon so powerful? 2
- 4. When the PAN and other card data is known fraud can be made with little efforts The PAN and other card data therefore is in PCI- Scope The weakest link makes the level of security Why Tokenization? What is the problem? Securing the Card Number (PAN)
- 5. Key and surrounding roles 5 Token Requestor Token Service Provider Card Issuer Merchant End User PSPScheme Acquirer NSP IoT Device Wallet (X Pay) TR TSP Issuer TSP
- 6. Card Issuer Token Service Provider Token Requestor Main Use Case: Digitize (Tokenize) Card 6 Yellow case Step up auth.
- 7. Main Use Case: Secure variant of Digitize 7 Token Requestor Token Service Provider Card Issuer authenticates Encrypted PAN Green case
- 8. Scaling Up Tokenization (1) 8 Token Requestor Token Service Provider Card Issuer
- 9. Scaling Up Tokenization (2) 9 Token Requestor Token Service Provider Card Issuer MDES, VTS, AETS
- 10. Scaling Up Tokenization (3) 10 Token Requestor Token Service Provider Card Issuer Aggregators Token Requestor TSP Card Issuer TSP
- 11. Know Usage for Mobile Contactless Payment 11 Enabling an App to perform mobile contactless payment at the POS Request Tokens via MDES, VTS etc. for Cloud Based Payments NFC Interface to Terminals nbased on Host Card Emulation (HCE) Replenishment of short living card keys to increase security (“SUK”, “LUK” instead of CMKs)
- 12. MyBankApp Accounts 6,750.00 Recent Transactions Ready to Pay Tokenization in use for Mobile Contactless Payments 12 Token Requestor (CMS-D, MAP) Scheme Token Service (MDES VTS AETS) Card Issuer authenticates Encrypted PAN PSP, Acquirer Network AuthDeTok.
- 13. E-Commerce Payment 13 Enabling an e-Commerce application for Payments Card Not Present and 3DS today’s prevailing methods for checkout
- 14. Concerns in eComm Payments 14 Risk/Fraud through different attacks Low Conversion rates on mobile channels Abandonning the checkout process Higher costs for CNP versus CP Merchant concerns Issuer concerns Risk/Fraud through different attacks Cost of customer care Lost transactional Revenue Consumer concerns Ease of onboarding Convience at shopping
- 15. Why not use Tokenization in e-Commerce? Each merchant does not store the PAN but a token Security will be Card Present like by using a cryptogram 15 The basic Ideas: Mastercard started M4M (MDES for Merchants) VISA speaking about Tokenizazion in eCommerce and Card of File (COF)
- 16. Tokenization in use for e-Commerce Payments 16 Token Requestor (CMS-D, MAP) Scheme Token Service (MDES VTS AETS) Card Issuer PSP, Acquirer Network AuthDeTok. COF PAN Entry
- 17. Use Cases Enroll: Add card manually or tokenize from card of file Display cards: Card art coming from token service (User sees his real card image) Transact: Generate EMV cryptogram (can be used for one or more transactions) Lifecycle: Issuer Account Update
- 18. Secure Remote Commerce 18 SRC Rocket still to be loaded
- 19. Secure Remote Commerce Framework (“SRC”) Defined by EMVCo ( /) Scheme agnostic to help interoperability Pay securely by credit card” button in checkout Will be scheme neutral successor of MasterPass & Visa Checkout starting 2019 / 2020 Will support card tokenization using MDES and VTS Will support card present type security (“cryptograms”) Demonstrator available from Netcetera, Training courses will be available
- 20. Roles used in SRC 20 Token Requestor Token Service Provider (Scheme) Card Issuer Supporting SRC SRC System Digital Card Facilitator Digital Shopping Application (aka Merchant) PSP SRC Inititator
- 21. SRC Flow once device is registered / returned user
- 22. Versus first time flow
- 23. Benefits Seamless experience – Starts with card entry like user is used to do No onboarding required – but device / merchant pairing possible from issuer app Works with all schemes in the same way Tokenization and EMV-like security will prevent fraud and lower the costs
- 24. As Issuer As Merchant As PSP As Acquirer How to approach this? Ask for a training on SRC done by our expert Thomas Fromherz
- 25. Europaplatz4 4020Linz Austria info@netcetera.com +43664 11211 00 Kurt Schmid Managing Director Digital Payment Kurt.Schmid@netcetera.com