February 2023 Summaries

Encryption and tokenization are complementary methods for protecting sensitive data such as personal information, cardholder details, and health records. Encryption transforms readable data into coded form that can be restored with the appropriate key, making it useful for securing communications, backups, and information that must remain usable in its original form, though compromised keys or sufficient computing power can expose it. Tokenization substitutes sensitive values with unrelated tokens while storing the originals in a secured vault, so tokens alone do not reveal the underlying data and can be safely used in business systems or shared with third parties. In online payments, encryption protects card data while it moves between customers, merchants, and payment providers, while tokenization limits the sensitive data retained in merchant databases. Combining both approaches can reduce breach exposure, simplify PCI-DSS compliance, limit employee access to raw data, and give merchants greater flexibility to use multiple payment service providers, although provider-issued tokens may create dependence on a single processor.

Cascading payments are a payment-processing approach that reroutes declined transactions through alternative payment service providers, gateways, or channels to give valid payments additional opportunities for approval. Unlike smart routing, which proactively selects the channel most likely to approve a transaction before it is submitted, cascading is a remedial process used after an initial decline and is often incorporated into a broader routing strategy. It can help address declines caused by issuer fraud controls, regional factors, processor outages, or other non-customer-correctable issues, while avoiding retries for errors such as invalid card details that require customer action. Proponents cite improved authorization rates, operational redundancy during provider disruptions, and stronger support for cross-border expansion as key advantages. Implementing cascading requires payment-engine rules for retrying failed transactions through other PSPs, along with access to card data or tokens that can be used across multiple providers, often through an internal cardholder-data environment or a tokenization platform.

Sensitive Authentication Data (SAD) is payment-card security information used to authenticate cardholders or authorize transactions, including PINs and PIN blocks, CVV or CVC codes, full magnetic-stripe track data, and emerging authentication methods such as biometrics. Unlike a primary account number, which identifies and routes a transaction, SAD helps verify that the person making a purchase possesses or owns the card, making it particularly valuable for fraud prevention. Under PCI DSS v4.0, most organizations may retain SAD only for the time needed to complete authorization and must then securely delete it, while card issuers may store it only when they have a documented business need and strong security protections, including encryption. Other cardholder data, such as PANs, names, and expiration dates, can be stored under extensive PCI DSS controls, although businesses may use specialized PCI-compliant service providers to reduce the cost and time required to build and maintain their own compliant environments.

January’s updates introduced temporary sessions as a more secure alternative to public API keys for handling sensitive data in public applications, with three-minute expiration periods, anonymous API prevention, front-end proxy or reactor access, and token-based CRUD support. The release also completed functionality for revealing full credit card information, including PANs, expiration dates, and CVCs, enabling card issuers and acceptors to support these workflows while reducing PCI exposure and integrating multiple payment providers through a unified experience. Card data capture Elements gained new attributes and event controls, such as card BIN and last-four detection, card-brand recognition, mask-status checks, validation during changes or blur events, and metadata access across web, iOS, and Android without requiring event subscriptions. Additional improvements included a new Elements overview page, Adobe Fonts support, configurable proxy transforms for GET and DELETE requests, reduced mounting timeouts, Datadog debugging integration, and stronger validation to prevent tokenization of invalid or incomplete input.