EPX began Offering Tokenization Solutions in 2001
Electronic Payment Exchange (EPX), a full-service payment processing organization, has entered is tenth year of issuing tokens as a means of securing credit card and ACH transaction data.
In early 2001, EPX engineered and deployed the payment industry’s first tokenization technology, which has protected hundreds of millions of financial transactions and helped merchants eliminate the liabilities associated with storing unprotected payment data. EPX’s proprietary tokenization technology replaces the sensitive payment information with unique IDs, which the payments industry has since come to call “tokens.”
For each transaction processed by EPX, patent-pending EPX BuyerWall™ technology issues a BRIC (BuyerWall Recognized Identification Code) token to the merchant, which is meaningless to would-be thieves. The BRIC allows the merchant to maintain total control of the customer experience and realize all of the capabilities that previously required the storage of cardholder data including refunds, recurring transactions, and historical review.
“As an innovator of tokenization in the payment processing space, we have been helping merchants effectively secure their payment data for nearly a decade,” said EPX Chief Security Officer Matt Ornce. “The industry has recently seen a rash of new entrants to the tokenization space. I applaud their efforts to catch up to our tokenization technology. However, I would caution merchants against using unproven solutions.”
“All tokens are not the same. Some tokenization solutions that have recently come to market don’t provide optimal security, since their tokens can be reverse-engineered to reveal their corresponding card numbers,” explains Ornce. “EPX tokens provide ultimate security because they are not derived from card numbers, and therefore cannot be reverse-engineered into meaningful data.”
Ornce says that another key differentiator between EPX’s tokenization solution and those of competitors is that EPX tokenization technology is “built in, not bolted on” to its payment processing platform. EPX’s payment processing platform was built with tokenization as an inherent component, while other payment processors have modified their legacy systems by adding on tokenization modules.
In addition to using tokenization for protecting credit card data, EPX tokenization technology has also been securing electronic check (ACH) payments since 2001. Contrary to recent claims by competing payment processors who reported that they were the first to offer tokenization of ACH data, EPX stands alone as the first to apply tokenization technology to ACH payments.
EPX has been an innovator and active leader in the payment processing space since 1979, and its nearly 10 years of using tokenization to protect credit card and ACH payments is further evidence of EPX’s commitment to protecting merchants. According to EPX Executive Vice President Charles Crawford, “In the 31 years EPX has been in the payments business, we have made many breakthroughs by simply pursuing what is most effective, what is most efficient, and what serves our merchants best. We’ve never waited for others to lead the way, nor will we in the future.”
EPX Welcomes Third-Party Validations of Tokenization and Payment Processing Outsourcing
Tuesday, July 20th, 2010Editor’s Note: It’s always encouraging to see EPX competitors follow in our footsteps. Just as competitors are following our lead by touting the benefits of tokenization technology, several competitors are even beginning to issue press releases that mirror ours. I guess imitation is the sincerest form of flattery.
Electronic Payment Exchange (EPX), a full-service payment processing organization, announced today that their organization welcomes the recent third-party validations of cardholder data tokenization and payment processing outsourcing. Newly announced global industry best practices for tokenization from Visa Inc. validate EPX’s long-standing deployment of tokenization technology for securing cardholder data. Additionally, a June 2010 security brief from RSA supports EPX’s approach to tokenized payment processing outsourcing by referencing an EPX client case study that shows how tokenization and payment processing outsourcing reduce merchant costs and other burdens associated with securing cardholder data.
The recent release of Visa’s tokenization best practices provides valuable guidance to merchant organizations seeking to utilize tokenization solutions for securing cardholder data. As the first organization in the payments industry to engineer and deploy tokenization technology, EPX welcomes Visa’s focus on and validation of tokenization solutions.
In version 1.0 of the Visa Best Practices for Tokenization document, Visa establishes best practices related to four critical components of tokenization: token generation, token mapping, card data vault, and cryptographic key management. Visa provides further recommendations regarding tokenization system configuration, implementation, and management, and offers guidance on the management of historical data.
EPX, which has offered merchants tokenization technology since 2001, abides by one hundred percent of the best practices established by Visa and views the best practices as reinforcement of EPX’s approach to tokenization. According to EPX Chief Security Officer Matt Ornce, “Visa is now confirming what we have been saying and practicing for years. Merchants that properly implement a sound tokenization solution are able to limit cardholder data storage in their environments. In turn, this simplifies merchant PCI DSS assessments by reducing the scope of their compliance requirements, associated costs, and implementation. This makes merchants of any size more secure and brings them into compliance easier, faster, and with less expense.”
Further validating EPX’s approach to payment data security, a June 2010 security brief released by RSA provides insight into how tokenization can be combined with payment processing outsourcing to relieve merchants of the burden and potential costs associated with securing cardholder payment data. Using an EPX client who annually processes tens of thousands of ecommerce transactions as an example, RSA pointed out that the merchant organization substantially reduced its PCI compliance burden. The security brief also establishes that, over the next several years, many payment processing organizations will introduce outsourced payment services to manage cardholder data risks on behalf of merchants. The brief provides additional insight by stating that the most effective outsourced payment services will use a combination of tokenization and encryption.
EPX has provided payment card security outsourcing for ten years and was the first payment processor to actually market, sell, and implement a solution that uses both tokenization and encryption for securing card data from the card swipe through the entire transaction lifecycle. By processing through EPX, individual merchants have reduced their initial PCI compliance burden by millions of dollars and continue to realize significant annual savings.
EPX welcomes the third-party validation of payment processing outsourcing and the use of tokenization plus encryption technologies. “It is great to see that leaders in the payments and security industries are recognizing EPX’s accomplishments,” EPX Chief Executive Officer Ray Moyer said.
Tags: BuyerWall, credit card processing, credit card processor, data breach, debit card processing, Electronic Payment Exchange, encryption, end-to-end encryption, EPX, matt ornce, payment processing, PCI compliance, PCI DSS, tokenization, VISA, VISA best practices
Posted in EPX Commentary, EPX News, Payments Industry News | No Comments »