Although I am all for tokenization, an issue has come to light recently that needs attention. After having conducted industry research and after inquiring with one of the major payment brands, it appears that neither investigators from the merchant side, nor law enforcement, will be able to identify the card issuer to follow up during investigations. This is because the only piece of information they will have from mobile payment solutions that use the payment brand token services is the token card number. This number is format preserving meaning that it's a 16 digit number like the actual credit card number, but the BIN does not match the true card issuer.

Via inquiry to one of the payment brand token groups, I was advised that the Interchange Directory File (IDF) can be used to identify the issuer from the token card number. However, there are two issues with this in that the IDF is not a publicly available tool and, after testing, it did not correctly identify the issuer during an Apple Pay test transaction for which we knew the issuer.

As a fraud and risk expert within the industry, and with a law enforcement background, this concerns me a great deal. I've worked many life endangerment cases such as kidnappings, etc, when timely follow up is critical to identify an account holder and locate the suspect via financial records. If my research is correct, then the only entities that can be effectively subpoenaed to identify the issuers are the card brands. This would add another legal step which is troublesome in already time sensitive matters.