Digital wallet tokenization

what is a digital wallet? a digital wallet securely stores payment information and credentials for electronic transactions you don't need physical cards the benefits include 1\ security benefits (the big win) tokenization returns tokens (not real card numbers) when someone steals data merchant tokens only work in specific places (like one specific phone or one specific merchant) stolen tokens are worthless elsewhere real world example think of tokens like hotel key cards if someone steals your hotel key card, they can only open your room at that hotel they cannot use it at other hotels or for anything else stealing your actual house key would be much worse that works everywhere business impact lower fraud losses fewer customer complaints better security without more work 2\ better customer experience what it means add a card to apple pay in seconds use the same card on phone, watch, and tablet get automatic updates when cards expire real world example before tokenization, your card expiration forced you to update your card number on 15 different websites expired with tokenization, that happens automatically netflix, spotify, gym membership all keep working business impact fewer failed payments less customer frustration lower support costs card provisioning card provisioning is the process of adding a payment card to a digital wallet (apple pay, google pay, samsung pay, etc ) cross river p1 supports multiple provisioning methods to enable cardholders to securely add their cards to digital wallets supported networks supported wallets visa token service (vts) mastercard digital enablement service (mdes) apple pay google pay samsung pay provisioning types 1\ manual provisioning description cardholder manually enters card details into the digital wallet app flow %%{init {'theme' 'base', 'themevariables' {'notebkgcolor' '#fff3cd', 'notetextcolor' '#333'}}}%% sequencediagram box rgba(66, 133, 244, 0 3) participant ch as 🧑 cardholder end box rgba(52, 168, 83, 0 3) participant w as 📱 wallet app\<br/>(apple pay / google pay) end box rgba(234, 67, 53, 0 3) participant cn as 🌐 card network\<br/>(vts / mdes) end box rgba(142, 36, 170, 0 3) participant cr as 🏦 cross river p1 end note over ch,cr 1️⃣ cardholder opens wallet ch >>w opens wallet app note over ch,cr 2️⃣ enters card details ch >>w enters card details note right of ch • primary account number (pan)\<br/>• expiry date\<br/>• cvv note over ch,cr 3️⃣ tokenization request w >>cn sends tokenization request note over ch,cr 4️⃣ forward to issuer cn >>cr forwards request to\<br/>cross river p1 note over ch,cr 5️⃣ risk checks & validation cr >>cr performs risk checks\<br/>and validation note over ch,cr 6️⃣ additional verification alt additional verification required cr >>ch requests otp\<br/>(via sms or email) ch >>cr submits otp end note over ch,cr 7️⃣ token creation cr >>cn approves tokenization cn >>cn creates and activates token note over ch,cr 8️⃣ token stored cn >>w delivers token w >>w token stored securely\<br/>in wallet note over w 🔒 token is device bound\<br/>and ready for use cardholder opens wallet app (apple pay, google pay, etc ) cardholder enters card details primary account number (pan) expiry date cvv wallet sends tokenization request to card network (vts or mdes) card network forwards request to cross river p1 cross river p1 performs risk checks and validation cross river p1 may require additional verification (otp via sms or email) upon approval, card network creates and activates token token is stored securely in the wallet use case cardholder adding card for the first time cardholder doesn't have access to partner's mobile app standard wallet provisioning without pre authentication advantages & disadvantages advantages disadvantages works with any wallet app no partner app required standard industry process manual data entry (friction) may require additional otp verification slower provisioning process 2\ tap to provision (nfc provisioning) description cardholder taps physical card to smartphone to provision card to digital wallet flow %%{init {'theme' 'base', 'themevariables' {'notebkgcolor' '#fff3cd', 'notetextcolor' '#333'}}}%% sequencediagram box rgba(66, 133, 244, 0 3) participant ch as 🧑 cardholder end box rgba(52, 168, 83, 0 3) participant w as 📱 wallet app end box rgba(255, 152, 0, 0 3) participant pc as 💳 physical card\<br/>(nfc) end box rgba(234, 67, 53, 0 3) participant cn as 🌐 card network\<br/>(vts / mdes) end box rgba(142, 36, 170, 0 3) participant cr as 🏦 cross river p1 end note over ch,cr 1️⃣ open wallet app ch >>w opens wallet app\<br/>on smartphone note over ch,cr 2️⃣ tap physical card ch >>pc taps physical card\<br/>to phone note over ch,cr 3️⃣ nfc card read pc >>w phone reads card data via nfc note right of pc • primary account number (pan)\<br/>• expiry date note over ch,cr 4️⃣ tokenization request w >>cn sends tokenization request note over ch,cr 5️⃣ forward to issuer cn >>cr forwards request to\<br/>cross river p1 note over ch,cr 6️⃣ validation & risk checks cr >>cr validates card and\<br/>performs risk checks note over ch,cr 7️⃣ additional verification alt verification required cr >>ch requests otp\<br/>(via sms or email) ch >>cr submits otp end note over ch,cr 8️⃣ token created cr >>cn approves tokenization cn >>cn creates and activates token note over ch,cr 9️⃣ card added to wallet cn >>w delivers token w >>w card added to wallet note over w 🔒 ready for contactless\<br/>payments cardholder opens wallet app on smartphone cardholder taps physical card to phone (nfc) phone reads card data via nfc (pan, expiry) wallet sends tokenization request to card network card network forwards request to cross river p1 cross river p1 validates card and performs risk checks cross river p1 may require verification (otp) token created and activated card added to wallet use case quick provisioning without manual data entry cardholder has physical card and nfc enabled phone alternative to manual entry advantages and disadvantages advantages disadvantages no manual typing required fast card data capture via nfc works with physical card requires nfc enabled phone requires physical card in hand may still require otp verification availability visa supported via visa token service mastercard supported via mdes cross river p1 all cards are contactless enabled and support tap to provision provisioning comparison type user effort speed otp required? partner app required? best for manual high (typing) slow often no first time users tap to provision low (1 tap) fast sometimes no physical card owners post provisioning process after any provisioning method, the following occurs token creation card network (vts or mdes) issues device specific token token is cryptographically linked to original card token is unique to device and wallet combination token storage token stored securely in device's secure element original pan never stored on device token cannot be extracted or cloned token activation visa/mastercard activates token token status updated in cross river p1 system card ready for transactions token management cross river p1 can suspend, resume, or delete tokens partner can manage tokens via api cardholder can manage tokens via wallet app cross river p1 provisioning capabilities cross river p1 manages provisioning tasks including 1\ risk checks geolocation validation cardholder verification fraud detection 2\ token status updates token activation token suspension token resumption token deletion 3\ token lifecycle management monitor token usage track token status process token renewal use cases use case 1 first time cardholder (manual provisioning) scenario new cardholder receives physical card, no mobile app implementation cardholder opens apple pay or google pay manually enters card details receives otp via sms completes verification result standard provisioning flow additional friction (manual entry + otp) longer time to wallet (minutes) use case 2 quick provisioning (tap to provision) scenario cardholder has physical card and nfc phone implementation cardholder opens wallet app taps card to phone card data captured via nfc otp verification (if required) result faster than manual (no typing) moderate friction (tap + possible otp) medium time to wallet network specific features visa token service (vts) supported provisioning types manual provisioning tap to provision key features cloud token framework (ctf) for connected devices visa card enrollment hub (vceh) for merchant initiated provisioning multi device token management risk based authentication mastercard digital enablement service (mdes) supported provisioning types manual provisioning tap to provision (nfc provisioning) key features remote notification service for token status updates token lifecycle management multi device tokenization enhanced security with cryptographic authentication