Explaining Visa Tokenization Innovation in Partnership with Omise to Enhance Security and Protect Credit Card Data Storage

Have you ever wondered where your 16-digit credit card number goes after you enter it on websites, e-commerce apps, or digital wallets, and how it is stored? For users, the “save card” feature offers convenience for future use.

However, from another perspective, this same data is highly sensitive and, if leaked, could affect cardholders, merchants, and financial institutions alike. With the growth of digital payments, the risk exposure expands. The question is not only "Is it easy to pay?" but also "How secure is it?" when using card numbers online.

/* No meaningful text to translate */ Visa, the global leader in digital payments, and Omise, a leading payment service provider in Southeast Asia, have collaborated to introduce the solution “Visa Network Token” to merchants across Thailand, enhancing payment system security and protecting Thai card data, while improving service efficiency that can significantly increase business revenue.

Tokenization transforms “card numbers” into “secret codes” for ultimate security.

Angsumalin Fordham, Head of Products and Value-Added Services at Visa Thailand, explained that traditionally, online payments use actual card data by entering the 16-digit card number to make purchases. The problem is that this 16-digit number is sensitive data stored in merchant systems (Card on File), which is vulnerable to leaks. If this data is leaked or hacked, criminals can immediately impersonate and make unauthorized payments. This exposes merchants to fraud risks and unnecessary transaction declines, directly impacting revenue.

Visa developed a technology to address this issue called “Visa Network Token.” Its basic operation is as follows:

• Visa Network Tokenization converts the 16-digit card number into a virtual code called a “Token.”
• For every payment, the system generates a dynamic security code known as a Cryptogram unique to that transaction. All data is securely stored only in Visa’s central Token Vault. Only Visa can link which Token corresponds to which card.
• When a Token is used, the data passes through Visa’s network to be converted back into the real card number before being forwarded to the issuing bank for transaction approval. Merchants do not have to store the actual card numbers in their systems.
• Tokens are domain-specific and device-specific (Domain Control), for example, Google Wallet, Apple Pay, or even a Smart Watch. Each Token is bound only to its designated device or website. A Token issued to Merchant A cannot be used by Merchant B, and a Token linked to one phone cannot be used on another device. Therefore, even if data leaks, it cannot be reused elsewhere.
• The system is designed for segmented management: if a phone is lost, only the Token on that device can be suspended while the real card remains active. If the real card is lost, only the card is blocked while Tokens on devices remain usable. This ensures uninterrupted use and reduces impact on cardholders.
• In the worst-case scenario, if a Token is stolen, it cannot be used fraudulently as it is only valid in its specified context. This reduces the value of stolen data (Devalue Data) and cuts the cycle of theft.
• The system also includes Token Lifecycle Management, automatically updating information when cards expire, are lost, or replaced. Customers do not need to re-enter card details, so subscription or automated payments continue smoothly.

Omise’s role as the intermediary simplifies complex processes.

Regarding this, Jitsupa Chiewwit, Senior Vice President, Head of Business Development (Asia Pacific) at Omise, revealed that Omise, as a Payment Service Provider, acts as the technological intermediary collaborating with Visa to widely implement theVisa Network Tokensolution for merchants and facilitates easier adoption by merchants, with main roles as follows:

1. Reducing complexity in system installation and development. A major concern for merchants is having to develop new systems. Omise helps by allowing merchants to start using Visa Network Token without modifying their front-end systems, reducing costs and time spent on hiring development teams.

2. Data migration service. For merchants that have long operated and stored customers' 16-digit card numbers in their systems, which pose high security risks, Omise assists by extracting and migrating those card numbers into highly secure Network Tokens.

3. Providing Payment Links for seamless data updates. If merchants need to collect new card data, such as when cards expire, Omise provides a "Payment Link" sent to customers. When customers enter card information through this link, the system immediately converts it into a Token, allowing merchants to update customer data securely and easily.

4. Consulting on business operational adjustments. Switching to a Token system requires backend changes. Omise assists by educating and guiding merchants on process adjustments, such as replacing card number searches with Customer ID or policy number searches.

5. Acting as Token Requestor and security standards overseer. Omise serves as the Token Requestor and complies with global security standards like PCI DSS, allowing merchants of all sizes to leverage Omise's system immediately without needing direct Visa integration or expensive PCI certification.

6. Implementing a gradual adoption strategy. Omise employs a flexible approach by allowing merchants to initially migrate only 20-30% of transactions to Token systems, enabling merchants to observe improvements. Omise focuses first on merchants with high-risk data storage, subscription businesses, and wallet applications.

Benefits for merchants.

1. Higher approval rates. Data shows merchants using Visa Network Token experience nearly 4.7% higher approval rates. Issuing banks have more confidence approving Tokenized transactions due to enhanced security and verification. This corresponds with reduced card declines; some merchants reported declines dropping from 20% to just 5% after adopting Token.

2. Reduced fraud. Additionally, merchants using Visa Network Token have seen up to a 30% reduction in payment fraud, with some cases reaching as much as 58%, depending on merchant and market.

3. Increased revenue. Merchants benefit from revenue continuity as the system automatically updates expired or replaced card data, reducing payment failures for subscriptions. Merchants using Visa Network Token via Omise report sales increases of approximately 0.5% to 1.5%, significant figures for businesses with millions in transactions.

Concrete use cases of implementation.

Currently, major operators in Thailand have begun adopting Visa Network Token solutions through collaboration with Omise, such as: Subscription and recurring payment businesses. For example, the water purifier brand Coway, as well as life insurance companies and streaming services. These sectors require consistent monthly billing.

Visa’s system includes Token Life Cycle Management, which automatically updates backend information when customers’ physical cards are lost or expire. Issuing banks update Tokens held by merchants accordingly, allowing uninterrupted monthly billing without suspending customer services or requiring merchants to request new card numbers.

Next is digital wallet applications. For example, TrueMoney, which allows many users to link credit cards within the app for payments at convenience stores like 7-Eleven or bill payments. The backend stores card data as Network Tokens. Even if the actual credit card expires, the Token linked to the app remains active, enabling seamless payments and avoiding delays at checkout.

Furthermore, Visa plans to expand support for guest checkout payments on websites where users rarely shop and prefer not to save card details. Users will no longer need to enter the 16-digit card number, expiration date, or CVV each time but can simply click "Click to Pay" and verify identity via email or phone number. The system will display a list of cards previously Tokenized for instant payment selection.

Visa is also developing systems allowing consumers to manage subscription services via banking apps. An API will enable issuing banks to connect mobile banking apps, letting cardholders view all websites or merchants with Tokenized card data and easily toggle or suspend recurring payments themselves, solving common difficulties in canceling services.

Angsumalin added that Visa Network Token technology has been developed since 2014, with over 16 billion Tokens worldwide today. Tokenization has become a fundamental pillar for safer, seamless online payments, boosting global e-commerce revenue by over 40 billion USD and reducing fraud losses by more than 650 million USD in the past year.

Regarding the security roadmap, the goal is to ensure the entire payment ecosystem achieves maximum security within 3 to 5 years, aiming to require merchants and payment service providers to shift from storing 16-digit card numbers to storing only Tokens.

However, no fixed timeline is set yet due to challenges from differing readiness levels among banks and merchants. Visa’s ultimate goal is to guide all card-data-involved transactions in Thailand to adopt Network Token technology fully in the future.

Follow the Facebook page: Thairath Money at the link -

https://www.facebook.com/ThairathMoney