December 2025 Summaries

A curated list identifies prominent payments and fintech professionals to follow in 2026, recognizing leaders who publish analysis, speak publicly, build companies, report on industry developments, and advance payment practices. Featured voices include Basis Theory CEO Colin Luce on payments as a profit center; Fintech Brain Food co-founder Simon Taylor and analyst Tom Noyes on infrastructure, tokenization, network economics, and interchange; and journalists Nicole Casperson, Karen Webster, and Kate Fitzgerald, who provide reporting, interviews, and industry context. The selection also highlights Marcel van Oost for market visualizations and news updates, Spiros Margaris and Chris Gledhill for perspectives on AI and innovation, Jim Marous for digital banking commentary, and Theodora Lau for consumer-focused and inclusive financial infrastructure. Sabine Vanderlinden and Neira Jones are noted for connecting innovation with adoption, investment, education, and industry outreach, while readers are invited to identify other people influencing the future of payments.

Credit and debit cards remain central to U.S. purchasing, but digital payments are expanding because wallets add convenience and security. A typical 15- or 16-digit card number contains identifiers for the card network, issuing institution, individual account, and a final checksum used to verify that the number is structurally valid, meaning several digits may be predictable to attackers. Although randomly guessing a specific active account is unlikely, criminals can acquire card data through breaches, social engineering, fake online stores, skimming, session hijacking, and automated testing of possible numbers. Chip cards, PINs, and portable payment terminals have reduced physical card fraud, while digital wallets increasingly protect card information through tokenization, local authentication, and transaction checks. Apple Pay’s merchant-specific payment account number, or MPAN, illustrates a model in which a token can be restricted to a particular merchant and type of charge, limiting its value if stolen. As payments increasingly shift toward digital wallets and virtual card credentials, merchants may need payment systems capable of securely managing tokenized data and flexible payment-service-provider relationships.

In 2025, Basis Theory focused on improving payment infrastructure for merchants and platforms through greater checkout resiliency, token portability, credential updating, and developer performance. Major releases included redesigned Apple Pay and Google Pay APIs with support for Apple Merchant PAN tokens for subscriptions, recurring payments, and card-on-file transactions, alongside automatic MPAN updates. The company also introduced full network-token support, enabling secure network-issued credentials for one-time, recurring, cross-border, and card-on-file payments while improving authorization rates and avoiding PAN storage. New List and Search endpoints delivered up to tenfold faster token queries, while a real-time account updater provided instant card-detail updates to reduce failed recurring payments and involuntary churn. Additional improvements included faster Web Elements and API performance, new SDKs, customizable and whitelabel payment components, strengthened 3DS integrations, BIN lookup, secure file storage, and tools intended to prepare customers for emerging payment models such as AI-assisted commerce.

As e-commerce growth heightens the importance of secure payment processing, card tokenization helps merchants protect customer card data by replacing it with an irreversible transaction-ready identifier, reducing breach exposure and supporting future purchases. Tokenization can fail because of malformed payment forms, connectivity or CDN outages, invalid card details, card-network rejections, or changing security protocols, potentially disrupting both an immediate sale and subsequent recurring or saved-card transactions. The impact and recovery options depend on where the failure occurs: network-level failures may allow customers to correct details and retry, while payment service provider (PSP)-level failures can introduce greater friction and fewer alternatives. The text argues that PSP-level tokenization carries the highest risk due to reliance on a single gateway, card-network tokenization has moderate risk because error codes can support retries, and programmable token vaults offer lower risk by enabling retries and routing transactions across multiple providers. Merchants can improve payment reliability and potentially lower processing costs by planning for failures, using geographically diverse PSPs, and adopting redundant, programmable token-vault systems.

A team supported an early Shopify Payments App adopter by integrating Shopify’s encrypted card-data workflow with the customer’s existing Node.js cardholder data environment. Shopify sends encrypted payment information through an mTLS-authenticated request, requiring the receiving system to validate Shopify’s self-signed certificates, return a prompt 200 OK response, and complete payment processing asynchronously. Using a programmable Basis Theory inbound proxy, the team designed a flow that decrypts Shopify’s ECIES-encrypted card data, tokenizes it, and forwards the original payload with a token replacing sensitive card information to the customer’s payment app, allowing it to use its preferred downstream acquirer. Because Shopify’s documentation initially provided only Ruby examples and no suitable Node.js package existed, the developer implemented the required ECIES hybrid decryption process in Node.js using ECDH shared-secret generation, key derivation, MAC validation, and payload decryption. After validating the proof of concept, adding key rotation, and refining the code, the team released an open-source Shopify JavaScript package for customers and the wider Node.js community.

European instant-payment rules required banks to receive instant transfers in early 2025 and, from October 2025, to send them around the clock, accelerating a shift already reflected in rising transaction volumes in systems such as the UK’s Faster Payments network. While consumers and merchants benefit from faster access to funds, improved cash flow, simpler reconciliation, and restrictions on extra instant-payment fees, banks face substantial infrastructure, liquidity-management, and profitability challenges because transfer delays and associated “float” income are eliminated. The irreversibility of instant payments also heightens fraud risks, prompting requirements for IBAN matching and increased use of AI and machine-learning tools, including behavioral monitoring, dynamic transaction scoring, and fraud checks across banks, gateways, and devices. Merchants are encouraged to reduce payment friction and manage failed transfers effectively, while balancing the security and compliance risks of storing customer data; programmable payment vaults are presented as one option for securely tokenizing payment information and connecting merchants with multiple payment providers.

Subscription-based fitness and health businesses, including gyms, telehealth providers, GLP-1 programs, supplement services, and wellness apps, can experience involuntary churn when recurring payments fail because cards expire, are replaced, or processors impose category restrictions. The piece argues that payment performance should be treated as a retention and operational concern, since failed merchant-initiated transactions can undermine customer acquisition economics, increase support requests, and interrupt services such as treatment plans or refills. It recommends a “vault-first” payment architecture built around an independent, PCI-compliant token vault that gives merchants control over payment data, supports multiple payment service providers, and reduces the need for card migrations or changes to subscription logic. It also highlights account updater services, preferably managed at the vault level, as a way to automatically refresh stored card details and reduce billing failures across processors. As companies expand across products, regions, risk categories, and payment methods, the approach is presented as enabling more flexible routing and processor additions while limiting engineering overhead, compliance scope, and disruptions to recurring revenue.