Credit card companies boosting security; Visa expanding tokenization to devices beyond Apple; Mastercard to spend $20M on biometrics, fingerprint matching
Update Planet Biometrics.com : MasterCard to invest US$20m in cybersecurity, launch biometric pilot Natalie Gagliordi / ZDNet : MasterCard, Visa make plays for payment security Jonathan Berr / CBS News : Visa and MasterCard are cranking up security Stephen Mayhew / BiometricUpdate : Mastercard, Visa to implement new cybersecurity measures and biometrics RTTNews : Credit Cards Adding New Protections Against Cyber Theft Alex Heath / Cult of Mac : Visa, MasterCard follow Apple Pay's lead with beefed-up security Business Wire : Visa to Remove 16-Digit Account Number in Online and Mobile Payments Jeremy Horwitz / 9to5Mac : Visa to follow Apple Pay's lead, use tokens for mobile & online payments PYMNTS.com : Visa Takes Tokens Online Payments News : Headline News from PaymentsNews.com Luisa Beltran / PE Hub Blog : Cavanaugh named President of Global Employment Solutions Robert Hackett / Fortune : Visa, MasterCard will shell out millions to beef up cyber defenses Tweets: Aaron Lucchetti / @aaronlucchetti : Mastercard looking to offer voice and facial recognition for customers to improve cybersecurity, http://www.wsj.com/... @WSJ $MA
Context & Ripple Effects
This piece is the opening beat of a decade-long authentication race at the two big card networks. In early 2015, Apple Pay had made tokenization the template for secure mobile payments, and Visa responded by extending tokens beyond Apple — even planning to drop the 16-digit account number from online and mobile transactions — while MasterCard committed US$20M to cybersecurity centered on fingerprint matching and a biometric pilot spanning fingerprint, voice, and facial recognition.
The arc since then shows that pilot maturing into strategy: Mastercard moved to accept selfies and fingerprints as password alternatives across the UK, US, Canada, and parts of Europe, tested opt-in facial recognition in Brazil with NEC, Payface, and PopID, and bought identity-verification firm Ekata for $850M. The counterweight arrived in 2022, when an FTC investigation probed whether the same security tokens restrict debit-card routing competition.
First-order effects
- Visa's move to strip the 16-digit account number out of online and mobile payments forces issuers and e-commerce merchants onto token-based credentials, replacing exposed card numbers with device-bound tokens.
- MasterCard's US$20M biometric program shifts customer authentication for its cardholders from passwords toward fingerprint, voice, and facial matching, beginning with its announced pilot.
Second-order effects
- By expanding tokenization beyond Apple, Visa opens the same secure-payment rails to rival devices and wallets, loosening Apple Pay's first-mover grip and pulling more hardware makers into the network's ecosystem.
- With both networks racing on biometrics, banks and merchants face parallel integration demands — new sensors, consent flows, and fallback paths — while fraud economics improve enough to make online checkout cheaper to protect.
Third-order effects
- The pattern points to card networks repositioning as identity-verification companies — the Ekata acquisition and Brazil face-pay tests extend them from authorizing transactions to certifying people — which concentrates consumer authentication power in fewer hands.
- That concentration carries regulatory risk: the FTC's routing-competition probe suggests token standards can double as chokepoints, so the same technology built to kill fraud may invite antitrust limits on how networks control digital payments.
The trend: Payment networks are evolving from account-number businesses into authentication platforms — tokens and biometrics replacing card numbers — with regulators now testing whether that security stack also restricts competition.