March 2023 Summaries

Card network tokens are random reference values that replace primary account numbers (PANs), with the actual card data stored in a secure token vault; unlike encrypted data, tokens have no algorithmic relationship to the PAN and cannot be decrypted into it. Major card networks including Visa, Mastercard, American Express, and Discover can issue merchant-specific tokens, while payment service providers may offer proprietary tokenization that keeps customer payment information out of merchants’ systems and can reduce compliance exposure. Potential merchant benefits include improved authorization rates and, in some regions, lower transaction costs, while limitations include initial provisioning latency, incomplete issuer and regional adoption, and complex integrations that may require additional decisioning tools. PSP-issued proprietary tokens can also tie merchants to a single provider for future transactions, whereas independent tokenization providers are presented as an option for maintaining token access across multiple PSPs. Although tokenization can reduce the risks associated with stored payment data, tokens should still be transmitted over encrypted connections as an additional security measure.

Basis Theory announced it has received SOC 2 Type I with HIPAA-related assurance and ISO 27001 certification, describing these independent assessments as validation of its approach to securing sensitive data. Its HIPAA compliance program includes administrative, technical, and organizational safeguards for protected health information, such as risk assessments, workforce training, access controls, encryption, audit logging, breach response, and business-continuity planning. The company says its infrastructure enables customers to store tokenized and de-identified health information, including medical records and identifying details, while reducing the need to operate their own HIPAA-compliant environments. ISO 27001 certification reflects an audited information security management system covering risk management, security controls, organizational policies, access management, cryptography, operations, supplier relationships, incident handling, and disaster recovery. Basis Theory states that these certifications support its continuing efforts to maintain cloud-native security practices, monitoring, and compliance for data stored in its vault.

Testing credit and debit card transactions helps developers verify payment-system logic without making real charges or reversing payments, using issuer-recognized test accounts that simulate network responses. Random numbers that pass the Luhn checksum are insufficient because they usually lack valid account, issuer, and security-code details, while card-number prefixes also identify brands and issuing institutions that systems must handle correctly. Common test numbers are available for major networks including Visa, Mastercard, American Express, Discover, Diners Club, JCB, and UnionPay, typically used with arbitrary CVC values and future expiration dates. Thorough testing can reduce the fixed fees charged for declined transactions, while payment service providers offer built-in validation tools for businesses using a single platform; organizations with multiple processors may instead route transactions dynamically based on cost or approval performance.

Payment network tokenization replaces card numbers and other sensitive payment data with unique tokens managed by networks such as Visa or Mastercard, allowing transactions to be processed without exposing the underlying information. It can improve authorization success because tokens may remain valid after a physical card is replaced, while also potentially lowering interchange costs, supporting larger transaction amounts, and reducing the exposure of personally identifiable information and cardholder data. Although payment service providers can simplify tokenization by supplying token vaults, keeping tokens within a PSP’s system can create vendor lock-in and limit the ability to switch processors or use multiple providers. A third-party token service provider with a PCI-DSS Level One-certified vault can instead store and provide network tokens independently, enabling merchants to route payments among multiple PSPs, pursue payment optimization strategies, and retain greater control over sensitive data.

PCI DSS 4.0, the major update to the global payment-card security standard, replaces version 3.2.1 after March 31, 2024 and introduces expanded security, documentation, and assessment expectations for merchants and service providers, including SaaS platforms. Organizations may use either the traditional defined approach or, for risk-mature entities undergoing a Report on Compliance assessment, a customized approach supported by control matrices, testing, and justification. Key changes include more detailed Attestations of Compliance, protections against remote copying of cardholder data, authenticated vulnerability scanning, stronger encryption practices for cloud and data-center environments, active malware scanning, corporate-wide anti-phishing controls, longer passwords, updated lockout thresholds, stronger MFA, service-account password rotation, and more continuous, zero-trust-oriented access decisions. PCI 4.0 also requires monitoring for failed security controls, tampering with payment-page content or headers, and covert malware communications, potentially requiring new tools, configurations, operating processes, and employee training. Businesses are encouraged to evaluate existing controls, identify technology and budget needs, and prepare for implementation, as compliance can improve security, partnerships, payment-provider interoperability, and customer experiences.

Basis Theory has launched Reveal, a feature that enables mobile and web applications to securely display sensitive information, including credit card data, without exposing underlying systems to that data or expanding their PCI compliance scope. Built on the company’s tokenization and Elements UI technology, Reveal is available through React, JavaScript, iOS, and Android SDKs and allows developers to create highly customized, responsive interfaces rather than relying on fixed payment-field designs. Its session-based access controls limit the duration and scope of access to sensitive tokens, reducing unauthorized-access risks while allowing teams to focus on product design. The feature is aimed particularly at card issuers, which can now present virtual card numbers, expiration dates, and CVC codes in flexible user flows, while also enabling users to copy card details for e-commerce purchases and potentially reduce entry errors and payment declines.

During February, the team focused on expanding its compliance platform so organizations can work with sensitive data more easily while reducing operational concerns. A major update introduced asynchronous reactors, extending compute time from 10 seconds to 3.5 minutes to support larger file processing, longer batch jobs, file transfers, and applications such as token synchronization, reporting, fraud analysis, and auditing. The release also added idempotency support for POST, PUT, and PATCH API requests, allowing clients to prevent duplicate processing through unique keys retained for 24 hours. The company highlighted its Reveal capability for securely displaying sensitive data across iOS, Android, and web SDKs, while changing token fingerprinting to opt-in by default for new tenants, with options to enable it for deduplication. Additional improvements included Reveal card-detail copying, iOS warning fixes, proxy and token performance enhancements, and simplified proxy calls through the JavaScript SDK.

Payment service providers are essential for processing merchant payments, but reliance on a single provider can create significant operational risk if an account is abruptly shut down because of high chargebacks, suspicious activity, fraud reports, or participation in industries considered high risk, such as gambling, CBD, and e-commerce. Merchants facing a shutdown should contact their provider to understand the issue, seek access to funds and payment data, appeal when appropriate, and quickly establish processing with another provider. The post emphasizes that merchants can reduce disruption by retaining ownership of payment tokens and customer payment data through a secure vault, rather than allowing a PSP to control those assets and create vendor lock-in. It also recommends integrating backup processors or more advanced smart-routing and cascading-payment systems, which can redirect transactions when one processor declines them or becomes unavailable.