September 2025 Summaries

Payment tokens are secure references to cardholder and other sensitive data stored elsewhere, helping merchants reduce PCI compliance burdens and avoid retaining plaintext personal information, which differs from encryption because tokens cannot be reversed into the underlying data. The main token types serve distinct purposes: PSP tokens offer simple implementation but generally bind merchants to a single payment provider; network tokens, issued by card networks for specific merchant-card pairs, can lower costs and improve security while remaining limited to payment credentials; and universal tokens, often supplied by third-party vault providers, can protect both payment and non-payment data across processors, networks, and channels. Selecting an approach depends on a merchant’s customer-experience goals, security needs, technical capabilities, processor strategy, and tolerance for vendor lock-in or service disruption. The discussion recommends considering combinations of token types to improve authorization rates, payment routing flexibility, transaction costs, compliance, and control over payment data.

Network tokens are card-network-issued payment credentials that replace primary account numbers for specific merchants, using a token requestor ID to authenticate transactions and potentially improve authorization rates, reduce fraud, and automatically accommodate card account updates. Their benefits depend heavily on implementation, transaction type, processor support, and merchant scale, as token processing can introduce several seconds of latency and may not produce meaningful incremental revenue if declined transactions were fraudulent or could be recovered through simpler retries. They are generally more suitable for large merchants, businesses with frequent card turnover, or cases where fraud reduction outweighs speed, including retrying initially failed transactions, while raw card numbers may remain preferable for fast, low-value, high-volume payments or where integration costs and processor compatibility are uncertain. Implementing network tokens requires obtaining them through card networks or tokenization providers, with approaches varying by PCI compliance status and the support offered by processors and acquirers.

Network tokens are card-network-issued replacements for primary account numbers that are tied to a merchant or device, use transaction-specific cryptograms for validation, and can reduce PCI exposure, fraud risk, and disruptions caused by expired or reissued cards. They are commonly used in merchant-initiated recurring-payment flows and may also support customer-initiated transactions, although those can require authentication and introduce latency. Token Requestor IDs identify the requesting merchant or provider, while tokens may originate from card networks, merchant-specific provisioning, or wallets such as Apple Pay and Google Pay. In agentic commerce, network tokens can allow verified software agents to make purchases using credentials constrained by amount, merchant category, and time, with card networks contributing fraud checks during provisioning. Additional potential applications include stablecoin-related closed-loop systems, gift-card and recurring-purchase programs, and debit-card routing, while Basis Theory presents its tools and documentation as support for merchants building agentic-commerce payment infrastructure.

Amid widespread enthusiasm but limited transaction volume for agentic commerce, the newly formed Agentic Commerce Consortium has released a whitepaper advocating for merchant-controlled participation in AI-driven purchasing rather than passive exposure to automated scraping. The initiative argues that consumer adoption of AI is increasing, particularly among younger users, but that practical commerce flows still largely require human involvement for authentication, verification, and intent confirmation, while the industry lacks a shared definition of agentic commerce. Its proposed roadmap emphasizes modernizing foundational internet and commerce infrastructure through APIs that allow merchants to control product discovery, catalogs, websites, carts, authorization, verification, and payments, while remaining compatible with emerging communication protocols such as Google’s Agent Payments Protocol and MCP. Supported by firms including Lithic, Skyfire, Rye, Crossmint, NewGen, Henry, Channel3, and Catalog, the consortium presents itself as a collaborative effort to address technical and commercial complexities across the ecosystem rather than as a single-company solution.

Payment processing enables transfers from buyers to merchants for goods and services through credit cards, ACH, cryptocurrencies, and other payment methods, involving the buyer, merchant, payment service provider, card network, customer bank, and merchant bank. For credit card payments, customer details move through security and fraud checks by the merchant, PSP, card network, and issuing bank, which approves or declines the transaction based on available funds and merchant credibility; the merchant initially receives only an authorization, while actual funds are settled later in batches. Merchants may use authorization holds to reserve customer funds when final charges are uncertain, as in hotel and car rental transactions, though these holds can inconvenience customers and create penalties if not closed promptly. Compliance with PCI-DSS rules for handling personal information is a major operational cost, leading many merchants to outsource data collection, storage, and tokenization to specialized providers. While relying on one PSP can simplify operations, larger merchants often use multiple providers to avoid outages or service disruptions and to negotiate better processing costs.

August’s updates introduced standalone Apple Pay and Google Pay endpoints to replace the older `/connections` endpoints, separating payment-method resource lifecycle management from Token Intents and preparing for Apple Merchant PAN support for recurring subscriptions and merchant-initiated transactions; the legacy endpoints are scheduled to shut down on December 1. Web Elements now support co-badged card handling to help meet EU Regulation 2015/751 requirements, with mobile support planned later, and can return BIN information after six card digits when the `binLookup` option is enabled. The release also added a `json_stringify` Liquid filter for serializing JSON in Proxy and Reactor expressions, improved Vault API behavior by retaining CVC during eligible card updates and adding major-brand enrichment fallbacks, and resolved Web Elements autofill styling and autocomplete issues in versions 1.23.1 and 1.24.0.

Payment authorization is the process by which a consumer’s financial institution confirms that a transaction is legitimate, funded, and permitted before the merchant captures the funds, making authorization rates a central measure of payments performance. Rates between 85% and 95% are generally desirable, while unusually low or sudden declines may indicate operational problems, fraud, chargeback pressure, or overly restrictive security controls. Merchants using a single payment service provider can improve results by validating and correctly transmitting cardholder data, adopting network tokens to reduce expiration-related declines and fraud exposure, and designing systems that detect network outages and queue valid transactions for later processing. Subscription businesses can also improve collections through decline-code tracking, dunning and retry programs, and billing schedules that avoid periods when customers may have low balances. Hard declines typically should not be retried, whereas soft declines such as insufficient funds or temporary system failures may succeed later. Although these practices can strengthen performance with one provider, using multiple PSPs can further optimize approvals by routing transactions to providers better suited to particular regions, currencies, or risk categories.

Real-money gaming platforms, classified under Merchant Category Code 7995, often face elevated payment declines and fraud risks that can undermine costly customer acquisition efforts. A programmable payments vault can help reduce these losses through BIN detection, which validates card issuer information, identifies issuing countries, supports transaction routing decisions, and can prevent invalid cards from reaching payment service providers. Short-lived token intents add a second pre-payment validation layer by enabling card and fraud checks before long-term token creation, while IP-based state restrictions can provide additional compliance and fraud protection. The text also highlights debundling Apple Pay and Google Pay to access device and biometric-related data that may strengthen fraud screening, arguing that these tools can improve payment conversion, reduce processing costs and declines, and create a smoother customer experience.

Visa’s Acquirer Monitoring Program (VAMP) consolidates former fraud and dispute monitoring processes into a single framework that measures initiated disputes and potentially fraudulent transactions, including TC40 and TC15 reports, against total transaction volume. It applies accountability to both merchants and acquiring banks, with acquirers facing a 50-basis-point threshold and merchants limited to 150 basis points through 2026 before the threshold falls to 90 basis points; exceeding these levels can lead to fees, remediation requirements, or loss of Visa processing privileges. Because acquirers’ portfolio-wide ratios can be affected by individual merchants, they may impose stricter internal limits than Visa’s formal thresholds. VAMP is presented as more stringent than earlier chargeback-focused rules because it counts potential fraud reports that may never become chargebacks and also addresses card-number enumeration. The discussion advises merchants to strengthen independent fraud controls, such as address and CVV verification, real-time detection, and 3-D Secure, while reducing dependence on a single payment service provider through multi-processor payment systems and secure payment-data storage.