I like the dynamic security approach with “a unique Device Account Number is assigned, encrypted and securely stored in the Secure Element on your iPhone or Apple Watch. Each transaction is authorized with a one-time unique number using your Device Account Number and instead of using the security code from the back of your card”, according to Apple.

But I’m very concerned that we are starting to see that “The one time code numbers that are part of the security scheme are not being accepted or read by terminals and their payment acceptance protocols.”

I like this granular tokenization approach in general but it will unfortunately require “token mapping tables”.

Recent data breaches are illustrating that there are many old and new ways to attack our sensitive data. Increasing sophistication of malware is a big concern. I think that data-centric security approaches, like data tokenization, should be used for all sensitive data, including PII, and it is time to secure the sensitive data in the entire data flow with data tokenization.

Ulf Mattsson, CTO Protegrity