Name: Authorization Success Starts at Vaulting: How Visa, PedidosYa, and Spreedly Drive Approval Performance
Uploaded: 2025-10-22T16:01:05.980Z
Duration: 32 min 5 s
Description: Authorization Success Starts at Vaulting: How Visa, PedidosYa, and Spreedly Drive Approval Performance

Transcript for "Authorization Success Starts at Vaulting: How Visa, PedidosYa, and Spreedly Drive Approval Performance": Hello everyone and welcome to today's webinar in partnership with Spreedly. And today's session is called Authorization Success Starts at Bolting, how Visa, PedidosYa and Spreedly drive approval performance. Today's session is all about staying ahead in a world where every transaction carries more data, more risk, and more opportunity. As payments become increasingly complex, one thing is clear, only flexible, secure systems can keep up. So today, we are bringing together industry experts to look at two key technological advances shaping the future of payments, tokenization and modern vaulting. Please welcome Andy McHale, senior director of product at Spreedly, Gonzalo Villar, payments director at Pediocia, and Benito Sandia Santiago, director of client strategy and solutions in North America for Visa. Great to see you all and welcome. Before we jump into this, we have a diverse mix of companies here. So I really want to get to know what authorization success means for each of you in your respective fields. Let's start with Andy alphabetically. Awesome. We said didn't go by last name. Usually, I'm in the middle of a pack by last name. No. It's a it's a great question, and it it's also a little nuanced. I think every business will look at authorization performance a little bit differently. Certainly, merchants can look at it perhaps from an order level perspective or from an individual transaction perspective, depending on their mix and how they they evaluate retries and those kinds of things. We on our platform, what we try to do is give the data back to the merchant so they're able to do those kinds of slices and and put the metrics together in a way that makes sense for them. The most bare bones common way is to simply look at just authorization performance and success on a transactional level, which is, the the most basic version. How about the detail? Next in the alphabet. Making it easy for you to. Yeah. Yeah. Well, yeah. The, tokenization is, one of the most important tools that we have to secure transactions. And, basically, the organization is replacing the, 16 digit numbers of the personal account number with a token, which is a randomly generated number that means nothing for the, for fraudsters. Okay? But this, this data, is also complemented with a couple of, very, very important things. One of them is the, cryptogram, which is a secure, a variable value that changes every every transaction. Right? So, when we initiate a transaction, we are securing transaction using the token, number one. So we are hiding the pan from, from the ecosystem. And number two, we are securing the transaction also using this cryptogram. By using cryptograms, we are, aiming for issuers to have a higher confidence on transactions. So when they see a transaction coming from a token based transaction, they will see that the cryptogram was valid or not, and then they will have more, yeah, reasons to approve or decline the transaction. So by using tokenization, we are aiming what exactly, Andy was was, focusing on. So we are aiming to reduce fraud and also reduce exposure of personal account numbers, for instance, increasing authorization rate. Brilliant. And Gonzalo? Yeah. So for authorization success for us means seamless payments. Yeah. We, from PedidosYa, we are the largest, delivery and food delivery and quick commerce company in Latin America. So, 91% of our payments are within, our app. So having a providing a seamless experience for our users is super key, and that's where authorization success play a key role for our experience. Brilliant. So as the only, like, I guess, non banking company on here, how do you balance the two pillars? So security and business improvement. How how important is it to recognize both sets of benefits? Yeah. So that's super important for us. Of course, network tokens provides both benefits from a risk perspective. Our chartered rate is three times higher when we see the rates without network tokens in our transactions. So having this feature in place for more than 75% of our payments share in the region is super, super important to mitigate, our our fraud metrics. And that's where, overall, we have, like, a quite healthy, trade. But when we see specifically the impact on network tokens, it's it's it's really important. Then, on the business development side, when we when we see this from a performance optic, it's super important as well. So we have seen use cases that, give us almost five points of uplift in in performance in in payments approval. So that depends on each case. Of course, we are present in 15 countries across the region and would depend on on on on a list of different variables when we say a bank an issuer bank, a specific country, a specific business line. But, overall, it provide us, excellent results in terms of performance. So what you're saying is it's not truly possible to have business improvement without a strong security foundation? Yeah. 100%. So apart from network network tokens, of course, we are we have in our road map, and we provide other solutions that would prevent fraud attacks to to our business, but network tokens is is really key. So mitigating the risk for our users makes them to have more confidence on our on our solution, on our service, and makes them to continue using our services. And that for when I say continue continue using our service, I mean frequency. Having a better, a higher frequency from our users for us is, like, the best experience that we can provide to them. So that's, like, a a a key KPI when we talk about payments. So what role does tokenization play in reducing fraud for you then, Benito, at Visa? Yeah. As I said before, by replacing the PAN, by removing the PAN from the ecosystem, we are reducing the risk on on the merchant side, and on the acquiring side to be exposed. Mhmm. So when when we perform tokenization, we are just introducing a data element that is linked to the merchant or to the device. So when, if there is any any or any security, security breach or or or somehow this data is exposed, that, this information cannot be used outside the, merchant or the device ecosystem. So for example, let's say if, I lose my my mobile device and the, the payment credential that is stored in my digital wallet there is somehow exposed or stolen, this information is useless outside the, the digital wallet ecosystem because the token that was created was linked to this specific real wallet. This is why it's it's important to us because it it is, an organization increases security, of course, and also, increases, and improves cost customer experience. So Gonzalo earlier, as I mentioned, card on file based business, and obviously getting repeat customers. Is that something that is of concern to Visa? Yes. Of course. So current file use cases, are also protected using network tokens, because when we create a token that is linked to a specific merchant, this is a current file use case, so this token cannot be used for a different merchant. Mhmm. So we are assigning a token a payment credential that is assigned to specific merchant. So, if this, data element is somehow exposed, as I said before, it is useless for for the parties. And also remember that I mentioned also that, every transaction is protected using a one time use scriptor. So every transaction, each time that the merchant wants to use or wants to initiate a a transaction using a token, specific, cryptogram for this very specific transaction needs needs to be provided by Visa. Brilliant. So, Andy, how are network tokens and vault enrichment shaping the future of payments? Things like transaction history, contextual data, and PR. Yeah. I think, I'll answer that question by, like, actually going back to what Benito and Gonzalo were just talking about. So the technology pieces that Benito was talking about, the collaboration between the issuer and the acquirers and the merchants, the merchant specific nature of the token, the issuing of a cryptogram by the token service provider every time a token is requested. All those things manifest in those consumer experiences Gonzalo was talking about of higher authorization rates. When you're ordering something via your app or online, that transaction goes through. And what's so important to merchants about that that transaction success in the way that, you know, those things pair together is it's not just that one transaction that you you make sure you decline. Gonzalo mentioned it before. It's it's the customer lifetime value, that customer's second, third, fourth, fifth transaction because we all know that when a customer has a bad experience in an ecommerce environment, they turn into a detractor. They don't come back. They tell their friends, and all those things kinda play into that. And so one of the things that's really important, when I talk to people about vaulting and tokenization is this, it's almost like preparation. It's getting things tokenized, getting things ready for that next transaction in a card on file experience so that that consumer, when they come back to your site, they're ready to transact. There's no interruption. There's no declines, and they're able to just keep going with with success and not have any interruptions to their experience. So I guess carrying on from that gotta keep going mentality, how does account updater functionality extend token value and reduce friction at checkout? Yeah. It's also a good question. You know, account updater is one of those pieces of technology that, sometimes can feel a little old when we're talking about some of the advanced things through through network tokenization. But, we certainly find in our ecosystem that it's it's very important in maintaining some of those values. Benito touched on this earlier as well, but the the the readiness of some participants in the network, how issuers, issue those things. Network tokens, aren't always available where we want them to be at a 100% yet. And so, account updater serves as a really nice companion to go along with network tokenization and the life cycle management that's already built into network tokenization to keep a transaction flowing, if you're storing cards in a vault, you know, sort of how we do for customers. So it really it I see it as a, you know, like I said, a companion along the journey to make sure that, again, thinking about that customer experience, when they come back, they can transact with that interruption. So, Benito, then how do tokenization products also work with other security products? Yeah. Right. I will talk about here two products. Yeah. That have been developed by Visa, by yeah. Which are pilot to Visa in in terms of security. One of them is three d s. The other one is, Visa data only. Remember, I I was saying before that with the network tokens, we are securing credentials or where the transaction is seen as from the usual side as more secure. But, we are also we are only protecting the credential. With three d s and Visa data only, we are also protecting transaction context. Mhmm. Mhmm. So with, with three d s, we are we are validating that the consumer is the legit user of this of this credential. So, we we are very used to, use CVS. I I I think on my side, I am. Any anytime that I'm buying something from from a merchant or, that is UDS compliant, I will receive a challenge from from the, from the issue issuer asking me, okay. You need to enter this and then to authenticate myself with a specific, tool. Yes. Right. Just to validate that I I am the lead user of this transaction. And this, provides a lot of benefits to to merchants and issuers because when we are securing the transaction, when we are authenticating the consumer, we are communicating this information from the merchant to the issuer. So we are letting know the issuer that this consumer was authenticated, that, which device this consumer was used, like IP address, the device fingerprint, etcetera. Right? So issuers have more information to approve or decline transactions. So that was on the three d s part. I also mentioned something called, Visa. This is this is a very interesting product that, at the end of the year of the day, misses the best of two worlds. So with three d, as I was saying, that there is some challenge on the on the consumer side, but that also means friction. Right? With, Visa, we are removing this friction, but but we keep we maintain sending this transaction context to issuers. So, basically, what happens with Visa is that we are still providing, IP address of the device, device fingerprint, billing address, email address from the consumer, and we're passing this information to issuers without challenging the issue, without introducing any friction. Just agreeing with with Benito on on the 3DS angle though there. Certainly, some of the things that we see in our performance data is when merchants, even in a nonregulated region, use 3DS, the frictionless flows or the data only flows. We absolutely do see authorization uplifts when those those things are provided in addition. Sometimes we forget in ecommerce that the issuers really don't get a lot of contextual data like Anita was was saying in a transaction. They don't see the card contents. They don't see a lot of the the session or the device biometrics or the telemetry that come along with that. And so other channels, you know, like 3DS data only and some of the other, products that are out there that the networks provide allow merchants to send that data to merchants. As I think about, you know, some of the future, of tokenization and some things, kind of throwing a softball up for Benito as well here. You know, authentication, like Benito was talking about, authentication of tokens, authentication of sessions will be really important in the future for how we tie devices together with tokens, together with merchants, and even further increase that security and reduce chargeback risk. So that was a really interesting point. What what do you see emerging now in this field that is gonna really change the game in the next five years? Yeah. I will talk about two another another few products that Visa is introducing, which are very, very noble and very, linked to tokenization. One of them is, what we call tap to everything. Mhmm. We are very used to tap or or payment cards in, for car parking transactions at the POS devices. But, we're introducing something that is called tap to add card and tap to confirm. So tap to add card, the first one. When we are, entering payment credentials in a in a mobile wallet, we normally have take a picture of the, of the card or I or or enter it, by hand manually the 16 digit numbers of the of the personal account number. With Step two Card, we are just enabling the, NFC antenna of the device and just tapping the, the, the card to capture the, not not only the 16 digits of the of the card, but also passing a dynamic cryptogram that secures and confirms, the, the presence of the card during during during provisioning. So we are securing provisioning. We are aiming to reduce fraud at, at, during provisioning time. Mhmm. Tap to confirm is also, another method to confirm possession of the car, and we are aiming to reduce fraud rates with the with by using tap to confirm. Another interesting product that we are also introducing and is, heavily relies on is Visa payment passkey. Visa payment passkey is, based on the file standard that allows consumers to authenticate themselves without using OTPs, without using passwords, and to authenticate consumers, by using biometric abilities of of mobile devices. These products are aimed to reduce, fraud, increase authorization rate, and also improve, user experience. All of them are built around network talking. Brilliant. Andy, I thought you had something to say. No. I I I'm I think just agreeing with Benito. And and as we, you know, hear what what our customers' needs are and what we see the networks and other other, you know, fintechs out there doing. It's definitely, there's a there's a movement towards, the sort of that next version of tokenization that's beneath you as subscribing. Passkeys is kind of the the current version of that. There may be other things in the future. And, you know, certainly, when we think about AgenTic commerce, you know, the the authentication, the delegation, the the tokenization of things will be so important for how the agent's use cases are actually crafted in the future and and ensuring that the agent actually has authority to operate on the consumer's behalf and that the agent is actually doing what the consumer said it was and that the agent is a fraud agent and we can have a whole separate webinar on that one. So Oh, we'll touch on a Genetec, commerce slightly later. But I I'm interested to hear what you think, Gonzalo, about regulation because I think, obviously, in a slightly different field, you're in more of a retail space. Have you got different different barriers that you have to tackle? So not when we see it at a regulatory point of view. I mean, there was there was a long process to roll out this this feature for us, within the region. But more than a regulatory barriers, I would say, we have a huge dependency, as Sandy was saying before, on the feature that supports the different players of the payments ecosystem. And when I say this, I mean issuers, acquirers, and different partners within the specific countries within the region needs to support this solution in order to provide network tokens for for our merchants and, of course, for our consumers. So that's super relevant for us when we talk about, continue expanding the payments ecosystem and the benefits of network tokens in the region. And since making payments, I guess, easier for the consumer, have you seen an uplift in in people ordering and the frequency of people ordering? Yeah. Yeah. Of course. 100%. Our our frequency within, in app payments when it when we say in app payments is when, our users pay with, digital payment methods, it's much higher than, of course, users that are that paid with, cash. Mhmm. So our our main goal is to continue cannibalizing, cash payments, and to incentive our users to move to digital payment methods. And that's where we, provide them a better experience, and, of course, a seamless experience that takes to have, like, a better frequency, within their consumer behavior. Just to maybe build on that a bit. Some of the things that, you know, we're seeing from our our corner of the industry is, you know, people kind of take for granted the tokenization and and the tokenization network tokenization certainly has been around since 2019 or maybe even a little before then. But we're actually not at Ubiquiti yet. We see a lot of merchants who are still adopting, and I even get questions, at industry events, you know, saying, like, is it too early to start getting into network tokens? Like, I've actually had people ask me that. I my response is, actually, you're late. Mhmm. You know, what and so how do we how do we enable merchants and and the the rest of the ecosystem to kinda get involved in this and start to take advantage of some of these things, around tokenization? And then there's other things that go along with the network token itself that can be valuable for merchants, par, for instance. So the primary account reference. We all know the PAN, which is the the 16 digit card number, but that's very specific to that payment method, and it's actually a transactable number. What the par value can do is based on the network tokens, give you a unique identifier that is available across different tokenization solutions so that merchants can actually start to tie together activity of a consumer across maybe a mobile app or an in store purchase if you're doing omnichannel transactions. Or perhaps if you're doing, other kinds of you know, maybe you're using multiple providers for your transaction processing, you have multiple network tokens for a single card, you can start to tie those things together. And like I mentioned for consumer loyalty, your other kinds of rewards programs, or even for fraud tracking just for for other kind of use cases. So there's there's other, call it metadata and other value add services that come along with the usage of tokenization on top of the security features. So I'm afraid we're gonna have to move on to our q and a section as we're running out of time. So the first one I'll refer to you, Gonzalo, and that is, have using network tokens made meaningful improvements in your transaction outcomes, or is it just a load of pipe? Yes. Of course. The impact has been very relevant for our business. As I mentioned before, fraud mitigation is one of those and then improving our approval rates as well. But we definitely have some space to continue this rollout or improvement around the solution. And as we were discussing as well, we need to continue expanding the coverage of this of the solution. We have 25% of our transactions share across the region that we are not being able to use network tokens, and that's why when when we have a dependency on, as we were saying, on a specific car brand car brand or an acquirer or an issuer, so that's where we need to continue improving in order to continue expanding the the benefits of network tokens in within Payi Osha and and our ecosystem. So, actually, how are you, kind of equipping your teams for that then? What's what's the next step for your for your teams? So we need we need to continue working together with Spreedly and our technological partners to expand our our coverage around network tokens. But when, as we were discussing before, we have other solutions in order to, mitigate the risk that we have, on our transactions, and that's when it comes for, three d s, another solution that that the card schemes are providing. And, of course, we are really, really interested in continue, providing a a safer experience for our users. Great. So this next one, I think, has your name written all over Andy, and that is, are there technical challenges to overcome in order to get started with network tokens? I know you said it's too late if you start now. It's never too late. Joking, of course. I think it the the answer to that question really is it depends. So if you're using, if you're trying to do these things on your own, there absolutely is work to do to, you know, integrate with someone, get network tokens, figure out how to send them to your PSP. If you're using a a PSP or it already supports network tokenization or if you're using an orchestration platform that perhaps already has an embedded, sometimes it's actually very little work in order to turn out those on. So, most of the time, your service provider, your your TSP, if you will, will enable you, get you set up for your your token request or ID, get all the back end work, and then be able to just backfill your vault with tokens and start provisioning network tokens, upon your request when you're making transactions. So there there can be a little bit of uplift. Like I mentioned, your mileage may vary depending on the type of integration you have, the number of integrations you have. But, thankfully, there's a lot of different ways to integrate with service providers out there that help alleviate a lot of those technical hurdles. So if you were giving one piece of advice to someone who's now about to take in, you know, start their tokenization journey, what would it be? Get started. Like, really, like Yesterday. It it it sounds it it sounds pejorative, but it's it's actually, you know, like most things in life, you just kinda have to take that first step and start to dig in and and and get the process going. You know, Gonzalo touched on this at a high level, but there's a lot of learnings you get as you start to use tokens and see what the benefits are. And then you can start to see what those advantages are and tweak and adjust inside of your own strategy to really take more advantage of those things and learn the right times to use them, when to request them, and and all those kinds of things. Brilliant. So, Benito, I know you may have already touched on this, but, the question is what what future features are the network's planning for network tokens, and how will they provide more functionality? Yeah. I I I wouldn't think of them as features, but, use cases. Yeah. With with network tokens, we see a a coming trend of new use cases. As I mentioned before, this tap to everything where we, can introduce payment credentials just by tapping a card into digital wallet. So this is by using network tokens, tap to confirm if just to confirm that we have possession of the card in an ecommerce transaction. We tap the card with the mobile device that's also using network token. There is also a a a different use case where we tap our mobile phones to do, p to p transfers that's also using network tokens. Now we have pass keys, Visa payment pass keys where we are securing network tokens to and linking those network tokens to a device and to a consumer by using biometrics. This is also relying on network token. Andy was also mentioning the, upcoming of iGentic commerce. So we have seen this this trend lately, where we, we'll have a new actor coming to coming to the ecosystem, which is the agent, which will perform transactions on behalf of consumers, in front of merchants, and in front of issuers, and which which, credential they are going to use are network tokens. So those are just to name a few of the new use cases that network tokens are are covering in the, in the near future. Brilliant. So you mentioned AgenTek Commerce, and the next question actually is about AgenTic Commerce. So, Andy, I'll throw this one to you. Does vaulting or PCI tokenization apply to other payment use cases like alternate payment methods or AgenTic Commerce? Mhmm. Yeah. It's a good one. I'm actually gonna go back to something Benito said at the top of the call because we we kinda just jumped into, like, the definition of, like, assuming everyone knows what tokenization is. But what, like, Benito called out earlier, tokenization is is the simplest act of replacing a sensitive piece of data with a non sensitive piece of data. And there are different ways to tokenize different sets of data. There are providers out there that can tokenize phone numbers, tokenize, you know, tax IDs and other kinds of of of PII. And and so PCI vaulting and and tokenization usually refers to when you have a provider that can tokenize a card, other, you know, an address, a name, all those kinds of things. And in our case, just to use my own company as an example, it's Freely. In our vault, we can tokenize the PAN. We even tokenize the network token. So we sort of tokenize the token, if you will. And we can put everything into kind of a a a secure central spot in the vault. And this can apply to alternate payment methods as well. You think about, bank payments where maybe it's a a routing number and a bank account number in The US or an IBAN in EU and other kinds of things that are don't fall under the scope of PCI. You can tokenize those things so that they're not, just broadly available and out in the clear. And Agenet Commerce will be based, as Benito was saying, around a lot of these tokenization concepts. So even if a payment isn't perhaps a a, a credit card directly, maybe it's maybe it's Apple Pay or it's Google Pay. Like I mentioned before, we could probably spend another two hours on this and and not scratch the surface, but that's at least how we're starting to think about Agenca Commerce in a way that the role that tokenization plays kind of in the upfront setup of it. Great. I love your company's policy to kind of tokenception there. Everything is so organized. But, yeah, I'm afraid, actually, we've now run out of time today. But thank you so much to both to all of you for your very insightful words. And thank you to everyone watching and for joining us today. This webinar will be online shortly, so you can come back and watch it again, and please share it with your colleagues. Thank you very much.