Technologies for Payment Fraud Prevention: EMV, Encryption and Tokenization
Publication Date: October 2014
Businesses processing credit and debit payments can help protect themselves against new and evolving fraud threats by implementing EMV chip technology, tokenization and encryption security technologies in conjunction.
Today, payments industry stakeholders are looking at many security technologies to protect their businesses and customers. This white paper explains how layering three of these technologies – chip, tokenization and encryption – in conjunction can help to secure the payments infrastructure and prevent card fraud. The degree of layering will differ among payments stakeholders depending on their requirements, environment and budget. Reading this white paper is a good start for any stakeholder starting to consider their best approach for implementing the three technologies.
The three technologies recommended in the white paper to be used in conjunction are:
- Chip technology, which improves the security of a payment transaction by providing cryptographic card authentication that helps protect against the acceptance of counterfeit cards. The EMV specification also offers cardholder verification and several means of transaction authentication that help safely authorize transactions
- Encryption, including end-to-end encryption (E2EE) or point-to-point encryption (P2PE), which can immediately encrypt card data at inception—at card swipe, key entry, tap or insertion—so that no one else can read it and use the card data for unauthorized transactions
- Tokenization, which replaces card data with surrogate values (i.e. “tokens”) that are unusable by outsiders and have no value outside of a specific merchant or acceptance channel
The white paper explains the three technologies in detail and how they can be implemented together. The white paper:
- Presents the authorization process for chip payments, drivers leading the U.S. to implement chip and the value of chip to issuers and merchants
- Discusses E2EE and P2PE, defining both while presenting different implementations of transaction encryption used by the payments industry
- Details tokenization – the standardization initiatives, its complementary role with respect to chip and encryption, assurance process for token issuance, and activities relative to tokenization that are taking place in the payments industry today
- Concludes with a discussion of how payments industry implementation of the three technologies together secures the payments infrastructure and prevents payment fraud
About the White Paper
The Smart Card Alliance Payments Council developed this white paper to educate payment industry stakeholders on the role of EMV, encryption and tokenization for securing the payments infrastructure and preventing payment fraud. Participants involved in the development of this white paper included: Accenture, American Express, Bell ID, CH2M Hill, Chase Card Services, CPI Card Group, Datacard Group, First Data Corporation, Fiserv, Inc., Gemalto, Giesecke & Devrient, Heartland Payment Systems, Ingenico, INSIDE Secure, MasterCard, NXP Semiconductors, Oberthur Technologies, SHAZAM, Tyfone, Valid USA, Vantiv, Visa Inc., Washington Metropolitan Area Transit Authority (WMATA), Wells Fargo.
About the Smart Card Alliance Payments Council
The Smart Card Alliance Payments Council focuses on facilitating the adoption of chip-enabled payments and payment applications in the U.S. through education programs for consumers, merchants, issuers, acquirers/processors, government regulators, mobile telecommunications providers and payments service providers. The group is bringing together payments industry stakeholders, including payments industry leaders, merchants and suppliers, and is working on projects related to implementing EMV, contactless payments, NFC-enabled payments and applications, mobile payments, and chip-enabled e-commerce. The Council’s primary goal is to inform and educate the market about the value of chip-enabled payments in improving the security of the payments infrastructure and in enhancing the value of payments and payment-related applications for industry stakeholders. Council participation is open to any Smart Card Alliance member who wishes to contribute to the Council projects.