EMVCo Updates Payment Tokenization Specification
March 31, 2016
EMVCo has updated its EMV payment tokenization specification to include a value called the Payment Account Reference (PAR). The organization said the measure will enhance security in payment networks by reducing the number of times a cardholder’s primary account number (PAN) is referenced throughout the payments ecosystem. EMVCo—a standards-setting body owned by the four major U.S. card networks plus UnionPay and JCB—said a PAR enables merchants, acquirers and payment processors to link to a cardholder’s payment token (the value that stands in for the PAN) without needing to use the underlying card account number.
“The presence of PAR fulfills a fundamental need to link PAN-based and token-based transactions together,” EMVCo said in a statement. “PAR enables the industry to move away from dependence on the PAN as the primary linkage. PAR data cannot be reverse-engineered to reveal the PAN or EMV Payment Token and cannot be used on its own to initiate a transaction such as authorization, capture, clearing or chargeback.”
While EMV was implemented in the U.S. to curtail card-present fraud, tokenization has become an increasingly important means for card-not-present merchants, who are not addressed by EMV, to protect payment card information from hackers who would try to steal it and use it to commit fraud. EMVCo has taken a very visible leadership role in devising a standard for this technology, although some groups claim it is shutting out some industry stakeholders .