Tokenization can help in card not present and NFC /QR code based mobile card present cases. However it will take considerable amount of time to roll out EMVCo Tokenization Framework across those channels, since it is not seamless and it requires all parties involved in payment transaction to make changes to their systems. That creats friction which slows down real life adoption regardless of the amount of marketing hype surrounding it. Plus payment networks want to charge additional fees for their tokenization services. That all increases transaction processing costs, which will be pushed all the way to the merchant. That in itself creates additional friction and contributes to further adoption slowdown.

On the other side EMV only protects from card cloning (by cryptographic card authentication via DDA/CDA) and transaction record replay (by creating the unique transaction cryptogram for each transaction). Physical plastic EMV chip-cards still 'leak' card number (PAN) in clear (unprotected) to merchant retail POS terminals. Those numbers can be stollen and used in online and MOTO purchases. We all know that those channels are not consistent in enforcing that merchants require CVV. On the other hand CVV does not work in automated / recurring payments.

Industry expects merchants to be dilligent in protecting sensitive card data like PAN. They are not. Security simply isn't their focus - their focus is selling goods

I believe that it should in fact be the responsibility of EMV card issuers and payment networks to protect card data before it gets to the retail POS terminals. EMV chip-cards are mini computers capable of advanced cryptography. They can seamlesly generate unique per transaction card number (using concept of End 2 End Format Preserving Encryption or E2EFPE). Those unique card numbers would behave as normal PAN (have the same 1st 6 digits as PAN) to the POS and Acquirer systems. Payment network would need to know how to decrypt it and restore real PAN before forwarding it to the card issuer for authorization processing.

E2EFPE seamlesly preserves ability of the participants to reliably detect usage of the same payment card in different transactions (despite usage of different card numbers in each of those transactions). This is extremely important for preserving ability of merchants to handle refunds, loyalty, transportation (tap-in / tap-out), etc

E2EFPE also does not modify existing EMV APDU protocol between card and POS, nor ISO8583 messages.

I have presented E2EFPE concept at CARTES 2014 conference last November in Paris and am scheduled to present it at CARTES Asia conference in March 2015 in Hong Kong.