Tokens: Merchant Options

Most retailers I’ve spoken with take the view “we just won Durbin and are in the midst of steering customers to debit.. why on earth would I want to support a new product type that is more expensive AND gives banks more control? AND further enhances merchant funded rewards? Will this improve my sales”?

26 June 2013

My last blogs on TCH tokens were rather controversial..  several of my bank friends will no longer take my calls.. while others are grateful that I’ve shown the light on a program they are scratching their heads on. I’m a reformed banker..  only partially cured of my myopia. Banks can choose to put me on the hit list or leverage this information to refocus their efforts toward delivering value (based upon feedback I’m getting on the other sides of the conversation). I can’t imagine trying to justify $200M cash burn on this business plan. Bank CEOs.. if you can’t understand the objective in 30 minutes it is not there.

Controversial points:

  • Banks are working to build a network that circumvents V/MA
  • Focus is replacing cards on file w/ token
  • Value proposition ill formed and poorly thought through (perhaps liability shift)
  • V/MA have their own token projects
  • V is contemplating using tokens to replace VBV, this would step on bank initiative (as is Masterpass)

This is the CEO level strategy war going on right now. So thought it would be good to give a summary to the retail/merchant audience.


FSIs aren’t big fans of Durbin, or of not having control over their payment rails and data. If you talk about or Masterpass to a card head their face will turn red. They are very frustrated that they can’t innovate in a 4 party network and that Amex is 5+ years ahead of them. Thus they are looking to build a new retail network that they can control.. not that there was much research on what the market needs.. it really didn’t matter. They knew what they wanted: Control and an “interchange” that is better than Durbin.

A very, very big bank “secret” is that fewer than 20 percent of any major issuer’s Credit Card portfolio has consumer cards that are transaction “thick” (more than 5 per month). Most credit cards are thus used for MAJOR purchases only. Banks want to increase credit card usage, lock customers into rich merchant funded reward schemes, AND increase the revenue of debit (when used). None of these objectives aligns to merchant needs.

How are the banks going to achieve their change? They have gotten together to create a new system. Of course anytime a group of competitors get together there are potential antitrust issues, hence they chose an existing entity in which to congregate. They also selected real issues like security, integrity, fraud, interbank clearing to focus their plans, and avoid regulatory scrutiny.  These issues are bank issues, as well as the pricing/control issues above. Given these design constraints you can imagine what they developed..  a bank friendly solution that has no market context.

A core requirement for any token pilot is that it is transparent to consumer. The perfect model for token issuance is OTA card provisioning in the NFC world.  From an economic perspective, Banks want to focus tokens at the POS as this is where the transaction volume is.. but NFC has not taken off, and there is no way for them to get POS adoption in light of MCX and general merchant resistance (although they continue to try). Thus token pilots are likely to be eCommerce focused (the have no choice.. ) and this puts them squarely in conflict with a very, very capable field of competitors with established solutions.

Network War

Per my blog Clusters Form, there are some VERY VERY high stakes battles being fought in the C suite.  For example, Visa is clearly positioned to deliver eCommerce tokens (as a replacement for VBV). In this model Visa would simply redefine VBV which already has bank “acceptance”, and would subsequently reduce CNP interchange and shift liability to issuer. If they did this, it would step on the TCH token project completely. Thus the large issers are threatening mutiny (with exception of BAC?). My guess is that Visa explicitly agreed NOT to do this with JPM in context of their new agreement (analysts/institutional investors please ask question).  With issuers threatening Visa mutiny… MA is not likely to be first to market on a similar solution w/ MasterPass.Network Clusters

What options does Visa/MA have to their own token project? Once one of them redefines tokens the other will follow.. if they don’t then COFs will not be theirs any longer.. they will have lost their acceptance brand. My guess is that the banks will give up on trying to do this themselves and will attempt to accomplish within the scope of V or MA’s rules.. But this defeats their primary control objective.

TCH Tokens – Value Proposition

As I stated last week in TCH Tokens: Any Volunteers, there are few merchants  or wallet providers jumping at the chance to participate in this pilot (POS or eCommerce). They want desperately to start a POS pilot, and may be forced to partner with a QR code solution provider with little to no merchant penetration. Why the merchant resistance?

Banks are not looking to solve a merchant problem, but rather their own.  How on earth can a merchant agree to participate in a pilot where rules are not defined, banks have more control, and the cost is higher than debit. The value proposition currently goes like this:

  • Give me your PANs and Cards on File.. and I will give you a token. (see Battle of the Cloud Part 4 and Business Implications of Tokens)
  • I may be able to take liability (not firmed up)
  • Since its really hard for us to do anything new at the POS, we will probably start with mCommerce and eCommerce and we will greatly improve your conversion rate by “auto filling” our customer’s name and address with the token. Since you have that already (given you had the card in the first place), perhaps we won’t really do anything new.. but hey we think we can.
  • You will have to change your processor to CMS or Elevon to process them
  • You will also have to retrain your fraud/customer support to handle all the special rules, and your customers will have no idea that they had a token to begin with
  • We want to price this higher than debit, but will give you a break on any debit cards.. but we won’t tell you which one is which.. because the customer may decide to switch (so we can lock them into rewards)
  • We will be able to give you a great new rewards/service using your data in the future. Not quite there yet.. but understand we will be the gateway between you and your customer forever…. So we want to justify the increased fees we plan to charge you once you have a number that only we understand.
  • We really love “partnerships” where we can control data.. so if you can please also give us any other data you have we may be able to use it as well.
  • Rules/Chargebacks.. hmmm.. haven’t gotten there yet. But we want to.. can’t we wait?

Ok, I’m rather harsh here.. partly for humor, but also to show how far they have to go for anyone to take this. As I mentioned in – Issuers Please Give me your Customers, there is enormous concentration in eCommerce: Cybersource, Amazon, eBay/PP/GSI and account for over 60%+ of eCommerce retail purchases. Would anyone use a wallet that they only used 1-2 times PER YEAR?

Think about how you buy today.. Amazon,, Staples, Apple itunes, Google Marketplace. How many other sites do you buy from?  Where else do you key in your name address, card number? Airlines and hotels lead the list for me. Am I going to put all of my cards in, Masterpass, or something else to help me (consumer)?

Let’s look at competing initiatives, do the banks really believe they can improve sales/conversions against these?

  • #1 eCommerce Amazon – One Click, #2 eCommerce PayPal, #3 eCommerce Google Chrome (and now with Instant Buy on phone as well)
  • #1 mCommerce Experience Apple iTunes, #2 Payfone – Leverages my phone/device to autofill everything, and phone/device/location information to manage fraud
  • – Autofills everything for eCom/mCom… can load any card
  • Apple (Future)? See blog
  • Existing services from CYBS/GSI


Assuming tokens are issued without customer action, Tokens still face a fundamental problem of acceptance. eCommerce acceptance is just as difficult as physical commerce acceptance (given the concentration of both), eCommerce/mCommerce just solves the problem of keeping tokens consumers transparency. Having a 16 digit number resolves most of the technical hurdles, however merchants must know (and agree to) the rules that surround accepting something that is not within their current processor agreement. What is the cost, who bears loss on fraud, return policy, refunds, rebates, compliance, support, …etc.   Taking a new product with new rules is not something done in the dark of night. The idea of a bank POS token pilot based upon QR code is completely laughable.. as this is yet another “token”.. and it now requires the consumer to do “something”. Once I require consumer participation, I now compete (conceptually) with NFC, Starbucks, Level up, Apple passbook and thousands of other apps.

Most retailers I’ve spoken with take the view “we just won Durbin and are in the midst of steering customers to debit.. why on earth would I want to support a new product type that is more expensive AND gives banks more control? AND further enhances merchant funded rewards? Will this improve my sales”?

Message to Merchants:

Tell them what your real problems are.. and see what they do to propose to help.   Tell them you do want to create better customer experiences both online and off line.. but when customers walk in your door they are not “Bank customers” … but yours.  200 years ago merchant banks were focused on helping merchants grow through industry insight and access to capital. How has your bank helped you grow lately?

Message to Banks

Listen, focus, find a real problem to solve for your merchant customers and consumers. Why do most product searches start on Amazon? What community have you enabled? What services do you perform for that 2% of transactions

Message to Acquirers

You have the merchant relationship and are best positioned for new data services.. you just need a consumer facing partner (Apple, Google, Amazon, …). I see great new things in your future.. particularly if you can deliver Least Cost Routing to Merchants. Perhaps the token platform should start with YOU.

Food for thought…

If you were going to redesign payments.. as an engineer… how should it work? Your money is with one institution that can communicate to any company.

Option 1

  1. Bank issues token to consumer
  2. Consumer Presents token to a merchant
  3. Merchant passes token to 3rd party that can route token to payment network
  4. Payment network routes token to bank
  5. Bank authorizes transaction
  6. Payment network sends authorization to merchant service provider
  7. Merchant receives authorization

Option 2 (Sofort, push payments, Debit Consolidation)

  1. Consumer instructs bank to send funds to merchant
  2. Merchant confirms funds are received

Payments – Wrapping, Rules, Acquiring and Tokens

if Google had challenges pulling off POS innovation (after ~$1B in investment), rest assured you will too. Banks are well positioned to throw sand in your gears … focus on delivering value within merchant –consumer relationship.

18 June 2013 (sorry for typos)

Thought it was time for blog this week. Primary objective is to inform the venture community of changes which may impact payment related start ups. Sorry that the title isn’t a little more polished (you can tell I’m rather left brained). The exec summary of this blog: don’t ever bet your business on someone else’s rules… particularly if they themselves don’t own them.


All Networks are working on unique token schemes (as I outlined in: Payment Tokenization, “New” ACH System, Visa’s Token Plans and Business Impact of Tokenization). The business drivers here are: #1 Control, #2 Mobile Payments. The US Banks have gotten together in The Clearing House (TCH Tokens) and are in the midst of piloting with 2 providers. In this TCH token initiative, the banks have logically determined that if a customer doesn’t need to see their Primary Account Number (PAN), then they will provide a number which they can uniquely resolve. For example, in mobile payments Citi could put in a unique Citi 16 digit number that is not a MasterCard, not a Visa card, not an ACH account number.. its just a Citi “token”.  Citi can decide how to resolve this number adaptively.. based upon what the customer wants, or what products they have with them.  There are MANY benefits to this approach:

  • Banks control account
  • Banks control DATA (transactional and account information)
  • Banks own network rules
  • No fees to other networks
  • Set unique (NON DURBIN) pricing for a NEW payment product.
  • No restrictions on “Routing”
  • Enables banks to “switch” providers of any payment service or network clearing
  • more detail here…etc

This is a BRILLIANT move by banks. I believe that this central bank “facility” within The Clearing House will be their centerpiece for consolidating all of Debit, in addition to the mobile play.

TCH Tokens are not the only game. Visa, Mastercard and Amex (through Serve) are also in this token game, and others like Payfone (through phone number as token at VZ/ATT), Google (through TXVIA) are also on the periphery. My view is that the BEST tokens are ones you don’t have to issue (ie Square/Voice, Apple/Biometric, Google/Facial Geometry, Payfone/Phone #…).  I outlined dynamics of the strategies in my blog last year “Directory Battle Part 1 – Battle of the Cloud”.  Its amazing that this topic is not covered more broadly in the mainstream… of course most of these efforts above are not discussed at all, and sometimes denied.

Of all the token initiatives, I believe Visa is most likely to succeed. This is not a typo… I’ve been very negative on Visa in the past.. as they have alienated everyone. But Charlie has started to change the culture, he has pulled the JPM relationship out of the toilet and has made a tremendous hire with Ryan. Why do I like Visa’s token prospects? They failed in their first initiative (non 16 digit PAN required big changes by everyone), and learned their lessons. However, most importantly, they can change the rates through rules on CNP and risk “ownership” creating a “new” version of VBV, with the best payment brand.


Currently the networks are at war with anyone attempting to wrap their product and add incremental value. As I outlined in Don’t Wrap Me, and Battle of the Cloud Part 3

The threat to banks from “plastic aggregation” at POS from solutions like Amex/Serve, PayPal/Discover, Square/Visa, MCX, Google is real. Make no mistake, Banks have legitimate concerns surrounding ability support consumers and adjust their risk models. But the real business driver here is to “influence” mobile payment solutions that do not align to their business objectives. Key areas for bank concerns:

  • Top of wallet card (how does card become default payment instrument)
  • Credit card ability to deliver other services (like offers, alerts, …)
  • Ability for issuer to strike unique pricing agreements w/ key merchants
  • Brand
  •  …etc

Visa, MA, Amex, DFS are in a great position to “stop” wrapping. What does this mean? They have initiated new rules, fees, cease and desists, threats of litigation …etc. Banks are thus looking to circumvent these restrictions by placing their “token” with the customer. This token is thus a new quasi acceptance “brand”.

Acceptance is therefore the new battle arena (who can convince merchants to accept their tokens, rules, rates, …). eCommerce may have slipped away from the banks and networks (PayPal), but they are determined not to let this happen in mCommerce, or at the POS.  JPM has structured its new agreement with Visa  to give them the flexibility on rules in acquiring and network routing for a new acceptance brand (Chase Merchant Services – CMS).


Retailers are not the dumb mutts that banks assume. The MCX consortium realizes that greater bank control does NOT benefit them unless the Visa ratesservice is ubiquitous and standard so that banks can compete against each other, with no switching costs. Analogy here is internet traffic routing…They just want the payment cleared, with transparency/control in price, speed, risk.  Retailers also want the death of bank card rewards schemes, and if they can’t kill them instantly, want the ability to deny “preferred” cards. I told a major retailer yesterday that they should offer an “X Prize” to anyone that can make sense of Visa’s rate structure in a youtube video.

Many Retailer’s also have a “token” in form of a loyalty card.. with Target’s Redcard, and Starbucks demonstrating the model in which a retailer led payment scheme could work. For retailers, their loyalty program is fundamentally about selling data, and trade spend.

As a side note, the “big” secret in acquisition is that most (~60%) of profits come from the bottom third of retailers.. specifically the small independents that don’t know enough to negotiate (hence the ISO business). Companies like Walmart negotiate heavily with the top issuers to reduce rates from “standard”.. and still end up paying over $1B a year.Square fees

I see a substantial opportunity for acquirers to participate in what I would discussed within Payment Enabled CRM. This would change their profitability from one driven by small merchants to data/analytics. This is undoubtedly what JPM sees within CMS. Retailers know that they can’t further empower the big bank with their data, but rather need an independent party to run the CRM platform for them.


I’ve already spent a little more time than I was anticipating here. For start ups my message is quite simple, if Google had challenges pulling off POS innovation (after ~$1B in investment), rest assured you will too. Banks are well positioned to throw sand in your gears … focus on delivering value within merchant –consumer relationship. The Mobile-retail interaction is greenfield, and there are 1000s of different flavors.. no one company will be the centerpiece here. Avoid POS payments.. or be the “arms provider” to the big institutions as they duke it out. My view is that the key for MNOs, Apple, Amazon, Google and Samsung’s future value is

#1 Authentication (Linking the Physical and Virtual World)

#2 Orchestration (Coordinating Virtual and Physical World Processes, Data and Value Chain)

EMV in US? No Way

Update Sept 2014

Did EMV in the US happen? Well to the surprise of issuers, Visa announced a scheme change in the US in August 2011 (see PR). The big issuers were not consulted about this program prior to rollout, as the dynamics described below in my previous article were occurring. Additionally banks were working on a new scheme that would leapfrog EMV: Tokenization.  The large banks were working on this scheme without the involvement of Visa and MA. If successful, this new token scheme would have bypassed V/MA altogether. I believe one of the reasons for this EMV push by Visa was to reassert its control of the network. Today we see quite a bit of friction remaining here between issuers and networks. See my blog on Chip and Signature for a view on some of the remaining chaos.

The new EMVCo token scheme announced in October 2013, formalized in March 2014 and rolled out first with ApplePay in Sept 2014 is the new “best” scheme on the planet. In this scheme, the networks have taken over the original bank token model. Of course banks can also serve as TSPs, but none of them are currently prepared (as of Sept 2014).


Original Oct 2009 A

As I was reading an article concerning “why US Card issuers should move to EMV”, I was struck by the amount of “disconnectedness” on this topic in the industry.

A quick background for those unfamiliar:

  • EMV is a “Chip” that replaces the mag stripe on a credit card
  • Rolled out in Europe in 2004 w/ hope that fraud would go down (it actually just shifted to Card not present “CNP” transactions)
  • European issuers are also acquirers. In US these functions have been separated w/ exception of AMEX
  • Europeans banks are complaining that US cards in EMEA markets and EMEA cards in US markets are the weaknesses in their beautiful vision of a “Chip world”. EMEA acquirers are also threatening to stop accepting US (mag stripe) cards.
  • US Adoption of EMV would take 10+ yrs for banks to re-issue cards and for all merchants to replace all terminals that use the mag strip.
  • Issuers in the US don’t collaborate very often because of anti-trust concerns. Rules are set by networks… in which banks are Board members. Big banks like competing through “best practice” in fraud management. Small issuers have trouble in the arms race.

US Issuers are exercising sound judgment in not jumping on the EMV bandwagon, yet many industry pundits (without access to the data) continue to push a POV that we in the US are somehow backward. Just take a look at the UK fraud data, the card losses have grown from 122M GBP in 1997 to 531M GBP in 2007, and 610GBP in 2008. What did the EMV investment “buy” the UK issuers? A detailed look at this fraud data (APACs confidential) shows that fraud adapted to the next weakest point in the card chain: CNP.

The US banks are highly motivated to do the right thing here, but the solution requires coordinated movement by 4+ highly fragmented groups (Issuers, Acquirers, Networks, Merchants).  The US banks do get together to discuss these topics, primarily at the Philadelphia Fed.  The top request from the banks (to their regulators) was to free their hands in working together on fraud and standards without fear of anti-trust reprisals.. A request that took on no owner, as the number of agencies involved were challenged to work between themselves (FTC, OCC, Fed, …)

Independent of the political challenges that the issuers face in the US, EMV is not the initiative to bring them together.

  • Old technology (will not last the 10yrs it will take to roll out in US)
  • Expensive (POS, Card). Costs are not borne equally in network
  • No proof point, fraud did not go down in UK, CNP was not addressed.
  • Fraud Shifts to the next weakest point, it is not static
  • Big issuers like to compete on risk management
  • No benefit from “incremental” rollout of any technology (below)
  • “Health” of issuers (below)

The “true” benefits of EMV will not occur until there is 100% adoption at POS (complete elimination of the mag stripe), and all other weaknesses are addressed (primarily CNP). That is the conundrum facing any new technology here:  New Plastic must completely replace the old. In other words there is no “Incremental” fraud savings to an incremental rollout.

Where there is chaos there is opportunity…

With respect to card use at the POS in the US, prospects for NFC in mobile handsets is very exciting. NFC enabled handsets provide great customer convenience and the cost(s) are not borne by the banks. I highly recommend the business whitepaper below for those interested in the subject.

Other Data

NCL losses of Top Issuers for 3Q09

Top 5 issuers have seen their businesses deteriorate substantially, as NCLs moved from ~3% in 2007 to 10-12% currently. 3Q09 Examples (Data is for QUARTER)

  • – Citi.  NCL of $4.2B,
  • – JPMC. NCL 9.41% (ex WaMu) Card Net Income ($700M) for quarter
  • – BAC. NCL $5.47B, 12.9%
  • – CapOne. NCL $2.3B, 10%