Mastercard at MRC Barcelona 2023: Network Tokens Are the Future of Payments

Mastercard believes tokenization is the wave of the future, and we’re in the second quarter of a four quarter game when it comes to progress in implementing network tokens across the payment ecosystem. This was one key takeaway from the MRC Barcelona 2023 conference that took place last month.

 “We want a network token-only future and we can get there in the next 10 years.”

said Anthony Pianezza, VP of Product Management for Card on File Tokenization at Mastercard, at a panel titled, “The Power Of Tokenization.”

History of Network Tokens

While all panel members agreed that network payment tokens will gain wide-scale acceptance in the future, card on file tokenization is by no means new.

Implementation of the technology began in 2018. Tokenization refers to the replacement of the long number on the front of the credit card, known as the funding primary account number (FPAN), with a network token also known as a device primary account number (DPAN).  For each authorization request for transactions using a network token, the device behind the DPAN also generates a unique cryptogram that must be authenticated by the card network. 

Using a network token removes the need to store clear text card numbers on any system in the payment chain, reducing the risk of fraud. This reduced fraud risk leads to higher authorization rates and lower interchange fees for token-based transactions.

“Network tokens have a higher conversion rate because issuers consider them more secure than FPANs"

said panel moderator John Krauss, Head of Braintree Product Operations, Strategy and GTM at PayPal.

A discussion on benefits of network tokens

The exact extent of the boost using network tokens provides was debated by the panel. Pianezza said that Mastercard merchants see on average a 3 percentage point increase in authorizations due to a switch from using FPANs to network tokens.

Uber, which was represented on the panel by Anne Yeung, shared that its first experience with tokens in 2019 in five different countries actually showed neutral to negative authorization results. However, by mid-2021, the company started to see a positive boost in authorization rates due to token usage of between 0.50 and 1 percentage points, in addition due to interchange discounts with the card networks. 

“Year over year we see greater adoption [of network tokens] by issuers and greater authorization rates benefits as issuers adjudication models adjust [to better assess the risk of token-based payments],”

said panel member Purnima Chaudhry, Director of Product Management at PayPal. 

“It could have been a question [whether to adopt tokens], maybe three years ago, but the people here today should adopt tokens. The ecosystem wants us to move to network tokens"

Chaudhry said in summing up the panel.

Issuer decline codes: an unresolved issue

Not everything at MRC Barcelona 2023 was future-oriented, however. An interesting session focused on an old issue that still hasn’t been solved: understanding the reasons behind issuer declines. 

Some merchants receive "Do Not Honor" for between 30 and 40 percent of their issuer declines, according to panel moderator Neil Hawkey, Global Head of Corporate Governance and Compliance at the payment processor Epoch. Yet, this category is so vague it does not provide clear guidance to the merchant on how to address the issues that prevent the issuer from authorizing the transaction.

However, Visa and MasterCard have instituted a rule that less than 5 percent of issuer declines may be attributed to “Do not honor,” otherwise the issuer will face fines. This has shifted the distribution of issuer declines. Two years ago, the largest category for declines was “Do not honor,”  according to Csongor Suba, fraud and investigations specialist at Payone, while today it is “Insufficient funds.”  This is not surprising, considering that the payment service provider Adyen estimated three years ago that up to half of “Do not honor” declines were really due to “Insufficient funds” that were miscoded by issuers.

This shows in general that issuers were using the “Do not honor” category, to mask the reasons behind declines, explained Rohan Jain, senior product manager for payment optimization at Worldpay from FIS. “Today, other categories are being used [for this purpose],” he said.

Mastering an authorization retry strategy

Why does this matter? Because merchants can retry a transaction that receives a soft decline, and the reason codes can be used as part of a strategy to determine when to do so. For this reason, Mastercard created in late 2021 an additional information field in issuer responses for Merchant Advice Codes (MAC). MACs in conjunction with the regular issuer response codes, guide the merchant regarding how they should react to a decline. For similar reasons, Visa grouped declines into four different categories, with different merchants' responses prescribed for each category. 

However, even with these changes seemingly nonsensical results will happen. For example, merchants in the panel complained that while the credit card schemes strongly discourage retrying transactions that receive hard declines, attempts to receive authorizations on these transactions can succeed enough to make them worthwhile even if the merchant must pay fines for doing so. This should not be the case, as a hard decline is supposed to indicate that an issuer will not authorize a transaction. The credit card schemes, according to merchants in the panel’s audience, claim that retries of hard declines will succeed less than 1 percent of the time – something the merchants present would strongly challenge.

The panel on issuer declines did not reach any simple conclusions. However, it did highlight the need for greater coordination among issuers and merchants on payment issues – something MRC CEO Julie Fergerson told the audience it could expect to hear more about in the future.