Securing Real-Time Payments With Tokenization

David Worthington, VP, Payments at Rambus

For banks, direct debit (ACH) fraud represents a bigger financial risk than card fraud. In particular, growing momentum for real-time payment schemes across the world is creating huge opportunities for fraudsters and placing increasing pressure on banks and clearing houses, who now have only seconds instead of days to identify fraudulent transactions.

There are various security approaches available to banks in the fight against fraud, but tokenization has already proved successful in protecting in-store and online card payments, with all the major payment systems, digital wallets and original equipment manufacturers adopting the technology.

By replacing unique sensitive information or data with a context-specific proxy, tokenization can significantly reduce the risk and impact of account-based fraud and foster safe, secure real-time payment initiatives across the world.

Adding tokenization to the real-time security mix

Financial institutions already deploy various techniques to prevent and mitigate ACH fraud.

David Worthington

Banks coordinate with agencies such as OFAC (Office of Foreign Assets Control) in the US and OFSI (Office of Financial Sanctions Implementation) in the UK to share intelligence and monitor suspicious entities or actions.

At a more practical level, out of pattern activity identifies irregular or unusual transactions, transaction limits help prevent high-value fraud, and ACH block services aim to root out unauthorized senders and recipients.

But it is old-fashioned manual review that continues to be a mainstay of bank processes. According to research from the Federal Reserve Bank of Minneapolis, 83% of banks in the US use this as a primary line of defense. This is simply not compatible with real-time payments and banks recognize the inherent limitations, with 43% per cent admitting it was “somewhat effective or ineffective”.

Tokenization is not a silver bullet. Rather, it is a process that should be considered as complementary to all existing anti-fraud measures, adding another robust layer of security and bringing unique benefits.

Mitigating account-based fraud

It is a hostile world, and for many organisations data breaches are more a case of ‘when’, not ‘if’.

Payment account tokenization mitigates the impact of data breaches when they are attempted, as sensitive account information is not stored in its raw form. This reduces the risk of stolen account numbers being used to commit transactional fraud, for example.

Similarly, control parameters limit how tokens can be used. So, if a token can only be used to pay a monthly direct debit to a specific merchant, it cannot then be used fraudulently to perform several person-to-person transactions on the same day.

Importantly, as an underlying single account credential can have multiple tokens associated with it supporting specific use-cases, banks can tailor the controls and limits they wish to put in place. If one is compromised, it can be quickly and easily replaced without impacting the main account credential or other associated tokens.

Faster, safer, easier

Tokenization as a technology is suitable to support multiple payment use cases via a single system, ensuring emerging commercial models and the ability to adapt to new requirements are not constrained by an inflexible security framework.

Also, tokens route normally through the payments systems and networks, so consumers and businesses can send and accept payments as normal with no change in authorizations. Depending on the system and token usage, tokens can be formatted and validated in the same way as the original credential, allowing non-disruptive use in an existing ecosystem to enable the swift onboarding of member financial institutions. And for new services, the token format can be simplified for frictionless use by the consumer.

For payment account tokenization to be effective, however, the infrastructure must be implemented at a systemic level.

This means Central Banks and Automated Clearing Houses have a crucial role to play in tokenizing the account numbers and managing the token vault – the centralized and highly secure server where the issued tokens and the account numbers they represent are stored.

Account-based tokenization beyond security

The main aim of tokenization is to protect account credentials to increase security.

There is an opportunity for banks, though, to take a wider view on the strategic use and potential of tokenization. Account-to-account based payment services, such as mobile payments and P2P, are increasingly popular following the introduction of regulation such as PSD2. Banks can use tokenization as a means to build stronger trust with customers through the provision of ever-simpler and seamless account-to account payments.

To learn more about real-time payments and how to secure them, download the Rambus eBook.

David Worthington, VP, Payments at Rambus

For banks, direct debit (ACH) fraud represents a bigger financial risk than card fraud. In particular, growing momentum for real-time payment schemes across the world is creating huge opportunities for fraudsters and placing increasing pressure on banks and clearing houses, who now have only seconds instead of days to identify fraudulent transactions.

There are various security approaches available to banks in the fight against fraud, but tokenization has already proved successful in protecting in-store and online card payments, with all the major payment systems, digital wallets and original equipment manufacturers adopting the technology.

By replacing unique sensitive information or data with a context-specific proxy, tokenization can significantly reduce the risk and impact of account-based fraud and foster safe, secure real-time payment initiatives across the world.

Adding tokenization to the real-time security mix

Financial institutions already deploy various techniques to prevent and mitigate ACH fraud.

David Worthington

Banks coordinate with agencies such as OFAC (Office of Foreign Assets Control) in the US and OFSI (Office of Financial Sanctions Implementation) in the UK to share intelligence and monitor suspicious entities or actions.

At a more practical level, out of pattern activity identifies irregular or unusual transactions, transaction limits help prevent high-value fraud, and ACH block services aim to root out unauthorized senders and recipients.

But it is old-fashioned manual review that continues to be a mainstay of bank processes. According to research from the Federal Reserve Bank of Minneapolis, 83% of banks in the US use this as a primary line of defense. This is simply not compatible with real-time payments and banks recognize the inherent limitations, with 43% per cent admitting it was “somewhat effective or ineffective”.

Tokenization is not a silver bullet. Rather, it is a process that should be considered as complementary to all existing anti-fraud measures, adding another robust layer of security and bringing unique benefits.

Mitigating account-based fraud

It is a hostile world, and for many organisations data breaches are more a case of ‘when’, not ‘if’.

Payment account tokenization mitigates the impact of data breaches when they are attempted, as sensitive account information is not stored in its raw form. This reduces the risk of stolen account numbers being used to commit transactional fraud, for example.

Similarly, control parameters limit how tokens can be used. So, if a token can only be used to pay a monthly direct debit to a specific merchant, it cannot then be used fraudulently to perform several person-to-person transactions on the same day.

Importantly, as an underlying single account credential can have multiple tokens associated with it supporting specific use-cases, banks can tailor the controls and limits they wish to put in place. If one is compromised, it can be quickly and easily replaced without impacting the main account credential or other associated tokens.

Faster, safer, easier

Tokenization as a technology is suitable to support multiple payment use cases via a single system, ensuring emerging commercial models and the ability to adapt to new requirements are not constrained by an inflexible security framework.

Also, tokens route normally through the payments systems and networks, so consumers and businesses can send and accept payments as normal with no change in authorizations. Depending on the system and token usage, tokens can be formatted and validated in the same way as the original credential, allowing non-disruptive use in an existing ecosystem to enable the swift onboarding of member financial institutions. And for new services, the token format can be simplified for frictionless use by the consumer.

For payment account tokenization to be effective, however, the infrastructure must be implemented at a systemic level.

This means Central Banks and Automated Clearing Houses have a crucial role to play in tokenizing the account numbers and managing the token vault – the centralized and highly secure server where the issued tokens and the account numbers they represent are stored.

Account-based tokenization beyond security

The main aim of tokenization is to protect account credentials to increase security.

There is an opportunity for banks, though, to take a wider view on the strategic use and potential of tokenization. Account-to-account based payment services, such as mobile payments and P2P, are increasingly popular following the introduction of regulation such as PSD2. Banks can use tokenization as a means to build stronger trust with customers through the provision of ever-simpler and seamless account-to account payments.

To learn more about real-time payments and how to secure them, download the Rambus eBook.