The value of tokenization — where sensitive information is replaced by unique algorithmically generated numbers and letters — has gained wide acknowledgement in commerce.
James Mirfin, Visa’s global head of Risk and Identity Solutions, told PYMNTS that fraudsters are perking up to tokenization’s potential to be used for illicit purposes.
Bad actors are illegitimately gaining access to, and provisioning, those tokens through ruses tied to social engineering and other scams as they lure issuers to grant them the tokens.
The costs are considerable: Visa has estimated that fraud losses reached an estimated $450 million globally in 2022 alone as fraudsters have used the tokens for subsequent transactions.
Broad-based data insights and the network effect, he said, can offer robust lines of defense against the scams, as one-time passwords and other means of risk management and authentication can be compromised.
“We’re in an arms race,” he told PYMNTS, “between the good guys and the bad guys.” The would-be criminals have access to AI and sophisticated models, and the optimal strategy is to fight fire with fire — with AI and sophisticated models, too.
The company said Wednesday (Dec. 13) that it had launched Visa Provisioning Intelligence (VPI), a new service for clients that leverages advanced technologies including AI and machine learning to predict token fraud by assigning risk scores to provisioning requests so that issuers can make informed decisions about whether to approve or deny those requests.
There’s a huge amount of data flowing across the network, said Mirfin, who added that real-time analysis is critical. “We bring all of these things together,” he said, “to make sure that we help issuers in the decisions they make on behalf of consumers — and make sure consumers have a positive experience when they are using a Visa credential, no matter where they choose to shop.”
Read more: Visa: Network Tokenization Shifts eCommerce Away From the Account Number
At a high level, he said, VPI’s machine learning identifies patterns in past token requests across device, eCommerce and card-on-file tokens. The model assigns a “fraud propensity score” on a scale of 1 to 99 that’s provided to the issuers upon each tokenization request.
“The issuer can use that score,” he said, “to make a risk-based decision on whether to approve or decline the request.”
Along the way, he said, gaining insight into good vs. fraudulent activity can reduce the number of false declines and boost payment volumes.
The hypothetical consumer who loads a debit card onto their phone, and specifically into a digital wallet, can then use that token with confidence, with the lowest level of friction, so that they can transact whenever and wherever they want to. Issuers are also given advanced authorization scores that allow them to continue to approve good transactions.
Asked about the value-added service’s road map, Mirfin said that VPI will be available as a global launch, available to issuers on the Visa network.
The broad strategy of VPI, he said, is to make sure that where fraudsters have been trying to coax information from consumers, Visa can help prevent that information from being used to provision a credential.
“That’s the focus,” Mirfin told PYMNTS, “and it all comes back to allowing ‘good’ consumers to transact as they move forward.”
We’re always on the lookout for opportunities to partner with innovators and disruptors.
Learn More