Explaining the Tokenization Innovation: Visa Partners with Omise to Enhance Security and Protect Credit Card Data Storage

Have you ever wondered where your 16-digit credit card number goes and how it is stored when entered on websites, e-commerce apps, or various wallets? For users, selecting “save card” offers convenience for future transactions.

However, that same data is highly sensitive; if leaked, it can impact cardholders, merchants, and financial institutions. With digital payments rapidly expanding, exposure to risk grows. The question is no longer just "Is paying easy?" but "How secure is it?" when using card numbers online.

. . . Visa, a global leader in digital payments, and Omise, a leading payment service provider in Southeast Asia, have partnered to introduce the "Visa Network Token" solution across merchants in Thailand, elevating the security of payment systems and protecting Thai card data, while enhancing service efficiency to significantly boost business revenue.

Tokenization transforms the “card number” into a “secret code” for ultimate security.

Angsumalin Fordham, Head of Product and Value-Added Services at Visa Thailand, explained that traditional online payments use the actual card data—entering the 16-digit number to make purchases. The issue is that this number is sensitive data stored on merchants' systems (Card on Files), which are vulnerable to leaks. If compromised, fraudsters can immediately impersonate the cardholder, forcing merchants to face fraud risks and unnecessary transaction declines that directly affect revenue.

Visa developed a technology to address this called "Visa Network Token," which operates as follows:

• Visa Network Tokenization converts the 16-digit card number into a virtual code called a “Token.”
• For every transaction, a dynamic security code called a Cryptogram is generated specifically for that transaction. All data is securely stored only in Visa’s central system (Token Vault). Only Visa can link which Token corresponds to which card.
• When a Token is used, data passes through Visa’s network to be converted back to the real card number and sent to the issuing bank for authorization. Merchants never store the actual card number in their systems.
• Tokens are bound specifically to websites or devices (Domain Control), such as Google Wallet, Apple Pay, or even Smart Watches. Each Token is restricted to a designated device or site; a Token for Merchant A cannot be used at Merchant B, and a Token linked to one phone cannot be used on another device. Thus, even if data leaks, it cannot be exploited elsewhere.
• The system is designed for compartmentalized management: if a phone is lost, only Tokens on that device can be suspended while the real card remains usable. Conversely, if the real card is lost, it can be blocked while Tokens on devices continue to function, minimizing disruption and impact on cardholders.
• In the worst case, if a Token is stolen, it cannot be used fraudulently outside its specified context, effectively devaluing the data and breaking the theft cycle.
• The system also features Token Lifecycle Management that automatically updates information when cards expire, are lost, or reissued. Customers need not re-enter card details, ensuring uninterrupted monthly or automatic payments.

Omise’s role as an intermediary simplifies complex processes.

Jitsupa Chiewwit, Senior Vice President and Head of Business Development (Asia Pacific) at Omise, revealed that Omise, as a Payment Service Provider, acts as a technology intermediary collaborating with Visa to widely implement the Visa Network Tokensolution to merchants, easing adoption with key roles:1.

Reducing installation and development complexity. Merchants’ main concern is the need for system redevelopment. Omise addresses this by enabling merchants to use Visa Network Token without modifying their front-end systems, lowering costs and development time. 2.

Data migration services. For long-standing merchants storing customers’ 16-digit card numbers—which carry high security risks—Omise assists in extracting and migrating those numbers into highly secure Network Tokens. 3.

Creating Payment Links for seamless data updates. When merchants need to collect new card data, such as expired cards, Omise provides a “Payment Link” tool sent to customers. When customers enter card details through this link, the system instantly converts them into Tokens, allowing merchants to update customer data securely and easily. 4.

Advising on business operational adjustments. Transitioning to Token systems requires backend changes. Omise educates and guides merchants to adjust workflows, for example, shifting from searching customer data by card number to using Customer ID or policy numbers. 5.

Serving as Token Requestor and security standards custodian. Omise acts as the Token Requestor and holds global PCI DSS security certification, allowing merchants, regardless of size, to join Omise’s system immediately without investing in direct Visa connections or costly PCI certifications. 6.

Implementing a phased adoption strategy. Omise encourages merchants to gradually adopt the system by migrating only 20-30% of transactions initially, demonstrating system improvements. Focus is on high-risk merchants, subscription businesses, and wallet apps first. Benefits for merchants:

1.

Higher approval rates. Data shows merchants using Visa Network Token experience nearly a 4.7% increase in transaction approvals. Issuing banks are more confident approving Token transactions because of their security and validation, reducing card declines. Some merchants reduced declines from 20% to 5% after adopting Tokens. 2.

Fraud reduction. Merchants using Visa Network Token report up to 30% reductions in payment fraud, with some cases seeing reductions as high as 58%, depending on merchant and market. 3.

Revenue uplift. Merchants enjoy more consistent revenue streams as expired or replaced card data updates automatically, reducing failed payments on subscriptions. Merchants using Visa Network Token via Omise report sales increases of approximately 0.5% to 1.5%, significant for businesses handling millions in transactions. Concrete use cases:

Major Thai businesses have begun implementing Visa Network Token through collaboration with Omise, such as:

Subscription and recurring payment businesses. Examples include water filter brand Coway and life insurance companies and streaming services, which rely on uninterrupted monthly billing. Visa’s system features Token Life Cycle Management, automatically updating backend data if customers’ plastic cards are lost or expire. Issuing banks update Tokens held by merchants, enabling uninterrupted monthly charges without suspending services or requiring customers to provide new card numbers, saving time and avoiding inconvenience.

Next are

digital wallet applications (E-Wallets). For example, TrueMoney, which many users link credit cards to for payments at convenience stores like 7-Eleven or bill payments. The system stores these cards as Network Tokens, so even if the physical card expires, the tokenized card in the app remains valid for continuous payments, preventing consumer delays or disruption at checkout. Additionally, Visa plans to expand support for guest checkout payments on websites where users visit infrequently and do not want to save card data. Users won't need to re-enter their 16-digit card number, expiration date, or CVV each time; they can simply click

"Click to Pay" and verify identity via email or phone number. The system then displays the user's previously tokenized cards for immediate payment selection. Visa is also developing features for consumers to manage subscriptions through banking apps, planning to launch APIs enabling issuing banks to connect with mobile banking apps. This will allow cardholders to view all websites or merchants linked to their Tokenized cards and easily toggle subscription payments on or off, simplifying cancellation processes that typically require direct merchant contact.

Angsumalin

added that Visa Network Token technology, developed since 2014, now supports over 16 billion Tokens worldwide. Tokenization has become a foundational element for secure and seamless online payments, boosting global e-commerce revenue by over 40 billion USD and reducing fraud losses by more than 650 million USD last year. Regarding a 3-5 year security roadmap aiming to maximize ecosystem safety, policy goals include mandating merchants and payment providers to store only Tokenized card data instead of raw 16-digit numbers.

No specific timeline has been set, as achieving 100% adoption is challenging due to varying readiness among banks and merchants. Visa’s ultimate goal is to guide all card-data-storing transactions in Thailand to use Network Token technology in the future.

Follow Thairath Money Facebook page at this link -

https://www.facebook.com/ThairathMoney