October 18, 2026, 8:30 a.m. (JST)
[Japan] This presentation outlines the direction of next-generation payments that balance convenience and security, centered on Mastercard’s MDES (Mastercard Digital Enablement Service), Click to Pay, and Passkey.(From a presentation at the “Payment Security Forum 2026 Fall” held on September 25, 2026)
Director
, Digital Payments, Product & Solutions, Mastercard Mr. Shoichi Tanaka
The e-commerce market is expanding
Online payments face fraud issues
I’m Shoichi Tanaka from Mastercard. Today, I’d like to speak on the topic, “From the Era of Protecting Card Numbers to the Era of Eliminating Them.” My presentation will focus on moving away from using or storing card numbers as-is in online payments and instead promoting tokenization, Passkey, and biometric authentication as standard practices.
Since tokenization is a technology that has been around for over 10 years, some of you may think it’s old news. However, its importance remains unchanged—and is actually growing. Today, I’d like to explain why it’s so important.
First, as a premise, the e-commerce market continues to expand in Japan as well as globally.According to data from the Ministry of Economy, Trade and Industry, the B2C e-commerce market was 12.7 trillion yen in 2014 and is projected to reach 26 trillion yen in 2024—more than doubling in size over the past decade. The security and convenience of online payments are as important now as ever—and perhaps even more so.
Amid this trend, online payments face the challenge of having about seven times more instances of fraud than in-person payments, and cardholders feel uneasy about registering their card numbers due to security concerns. More than half of them worry that their information might be leaked or that the Merchant might be a fraudulent one to begin with.However, simply tightening security isn’t the answer—that would make the checkout process too complex and time-consuming, and there’s a risk that customers will abandon their carts due to the one-time passwords required by 3-D Secure.
In response, Mastercard offers contactless payment and Contactless Payment options, providing both security and convenience for in-person transactions. For online payments—which have become part of our daily infrastructure—there is also a demand for solutions that combine security and convenience.
Online payments still face challenges: entering card information, passwords, and concerns about Fraud. These issues hinder a smooth payment experience. Mastercard and the payment industry are working to ensure that online payments are as fast, simple, and secure as in-person Contactless Payments.
By combining network tokenization (Secure Card on File), biometric authentication, and seamless guest checkout, we are establishing a new standard tailored to today’s consumers.
Our goal is to tokenize every card from the moment it is issued and protect it from fraud. Furthermore, when cards are renewed or reissued, the stored information is automatically updated to ensure security at all times.We eliminate the hassle of entering passwords and enable one-click biometric authentication through the Mastercard Payment Passkey Service. Furthermore, we automatically register all cards with Click to Pay. By integrating Click to Pay into Merchant checkout processes, we provide users worldwide with a faster payment experience. This is the new industry standard.During digital payments, the system recognizes the user, displays their preferred payment method, and verifies their identity through biometric authentication. No card information or passwords are required. The goal is to deliver a simple and secure online payment experience anytime, anywhere, and in whatever way the user prefers.
100% Tokenization and 100% Identity Verification
Reducing Fraud Through Tokenization
Mastercard has set forth its “Vision 2030” in this regard, aiming to achieve 100% tokenization and 100% online transactions without manual identity verification by 2030. Tokenization and Passkey are essential to achieving this. Three core technologies are required:The first is network tokenization, which ensures that card numbers are neither used nor stored during transactions. The second is “Click to Pay,” a seamless checkout experience. The third is biometric authentication, which eliminates the need to manually enter one-time passwords.
By advancing these three initiatives, we are working to create a wonderful world of payments.
First, let’s look at network tokenization. Looking at the trend of credit card fraud in Japan, the increase has been particularly pronounced since 2020; the vast majority of fraud—over 90%—involves online transactions using stolen card numbers.The financial losses from fraud have also been on an upward trend; while they have declined slightly due to the mandatory implementation of 3-DS, the amounts involved remain substantial. On the other hand, around the year 2000, the proportion of losses due to counterfeit cards was rising, but with the introduction of IC cards, that proportion dropped sharply. Subsequently, Contactless Payment became available, greatly enhancing convenience.Security has also improved with biometric authentication, and the ability to make contactless payments even for purchases of 15,000 yen or more has further enhanced convenience.
In contrast, what has been on the rise are online transactions and cases of card number theft. Entering a 16-digit card number for an online transaction and then submitting it for authorization is, in terms of face-to-face transactions, equivalent to the magnetic stripe era—meaning the number must be concealed.
Payment tokenization is the process of replacing the 16-digit number on a plastic card—known as the PAN—with a unique 16-digit substitute, known as a token.It’s not just a simple replacement; the token is generated and uniquely linked to the member’s information, the Merchant, and the specific transaction device. When this information is sent for authorization, it is encrypted. For example, since the number is altered, a token stolen at Merchant A won’t work at Merchant B.Additionally, since a timestamp is included in the transmission, a token generated today cannot be used two months later. This renders attacks that rely on stealing numbers through credential stuffing attacks meaningless, thereby reducing fraud.
What is an MDES token?
Rapidly gaining traction in the APAC region
What is the difference between PSP (Payment Service Provider) tokenization and Mastercard’s tokenization? PSP tokenization essentially only tokenizes data between the Merchant and the PSP; beyond that point, transactions proceed using the standard card number (PAN).In contrast, Mastercard’s MDES protects card information throughout the entire payment flow.Once tokenization occurs—from the merchant to the Acquirer—the PAN is never exposed; only the token is used. Mastercard converts the token back to the PAN, verifies the unique information with the Issuer, and then processes the transaction. As a result, card information is protected throughout the entire payment flow, fraud is reduced, and the Authorization Rate improves—these are the benefits of tokenization.
The Authorization Rate for online transactions in the Asia-Pacific region is 89.6%; while it is slightly higher in Japan, tokenization boosts this rate to 96.1%—an increase of about 6%. Furthermore, when combined with strong customer authentication, the Authorization Rate rises to 97.6%.Compared to using 3-DS for identity verification in PAN transactions, tokenized transactions yield a higher Authorization Rate even without identity verification. We believe the main reason for this is that Issuer can approve transactions with confidence, and since it is more difficult for attackers to carry out attacks, there are fewer fraudulent transactions to begin with.
Another reason for the higher Authorization Rate is that tokens offer superior lifecycle management. Lifecycle management essentially refers to what is known in Japanese as “card renewal.” When a card expires, the card number information is updated to prevent errors in recurring payments.
In Japan’s traditional lifecycle management system, Acquirers and Issuers enter into bilateral agreements to periodically update PAN information on a case-by-case basis. With bilateral agreements, cards from overseas Issuers may not be reissued, and in some cases, new Issuers may not be kept up to date, so coverage is not perfect.
With tokenization, the Acquirer sends a token, which Mastercard converts back to a PAN and passes to the Issuer. Suppose the cardholder’s PAN has changed at this point. Currently, under Mastercard’s global rules, issuers are required to have this change managed by Mastercard’s ABU (Automatic Billing Updater).The ABU updates Mastercard’s mapping table in real time. As a result, the Acquirer doesn’t need to take any action; simply by continuing to use the exact same token, the PAN information sent to the Issuer is updated without causing any errors.
Furthermore, since this system operates globally, card information for both domestic and international issuers is automatically synchronized, and no action is required on the part of the Acquirer. It’s important to emphasize that even though the PAN has changed, the Acquirer doesn’t even need to be aware that the PAN has changed. Cardholders also do not need to take any action regarding the PAN.
By implementing tokenization in this way, you can prevent fraud, improve Authorization Rates, and—since it can be done throughout the card lifecycle—reduce both revenue loss and administrative burden.
In the Asia-Pacific region, approximately half of all online transactions processed by Mastercard are tokenized. In some countries, this figure reaches as high as 70% or 80%.In Japan as well, about 20% to 30% of transactions are being tokenized behind the scenes. If this trend continues, we believe that nearly all transactions will be tokenized behind the scenes, and the number of cases where recurring payments are not processed will decrease.
Promoting
Click to Pay and Payment Passkey Balancing Convenience and Security
The second and third initiatives eliminate the need to enter card numbers or passwords; specifically, these solutions are called Click to Pay and Payment Passkey.
Eliminating manual input improves both convenience and security. The convenience aspect is self-explanatory. Entering a 16-digit card number can lead to abandoned carts, and customers may miss the one-time password they received, preventing them from completing a purchase; therefore, being able to automatically select biometric authentication is extremely convenient.
From a security perspective, given the increasingly sophisticated attack methods of recent years, manually entering either a card number or a password poses a risk in and of itself. For example, real-time phishing cannot be prevented by traditional 3-DS one-time passwords. Real-time phishing begins by redirecting cardholders to a fake website that appears to be the genuine one.When the cardholder enters their card number, the attacker on the fake site sends that information directly to the genuine site. The cardholder, who receives the one-time password on the genuine site, then enters it on the fake site. The attacker then enters the one-time password into the genuine site, resulting in fraudulent activity.
Recently, as AI technology has advanced, it has become increasingly difficult to ensure that all cardholders are not deceived. This raises the question: Is relying on information known only to the cardholder for verification truly secure? I believe it is necessary to use biometric authentication—information that the cardholder cannot physically hand over to an attacker—even if the cardholder has been deceived.
For users and merchants equipped with Click to Pay and Passkey, the checkout process previously required entering a 16-digit number to complete a purchase. With Click to Pay, once the user’s identity is verified via biometric authentication—and the card number is confirmed—the purchase can be completed after an additional security verification step, such as Face ID.
From the perspective of real-time phishing, since neither the card number nor the password is entered, there is no opportunity for eavesdropping, making it secure. From the user’s perspective, it’s simple—just one button press after facial recognition—and helps prevent abandoned carts. Using Click to Pay and Passkey enables a simple, secure, and fast checkout experience.
For merchants that process transactions on a per-transaction basis, entering card information can lead to abandoned carts, and many users feel uneasy about it, so this can be a highly effective solution.
Registering
Card Information in the Mastercard Credential Directory Building the Foundation for the Online Shopping Experience
Mastercard pre-registers cardholder information in the Mastercard Credential Directory—a directory system that centrally manages and hosts users’ payment credentials (such as credit card information and digital profiles)—and generates tokens in advance.As a result, at Click to Pay merchant locations, both the merchant and the Acquirer can use these tokens to process transactions.
The key question is, “How much user information is stored in this Credential Directory?” Mastercard aims to have all Issuer’s cards registered on this server at the time of issuance. In some countries in the Asia-Pacific region, it has become mandatory to register cardholder information in the Credential Directory at the time of card issuance, and this practice is growing.New Zealand and Australia are leading the way, with 80%—and in some cases, nearly 100%—of all cards registered in this Credential Directory. Once we reach that level, the Click to Pay solution becomes extremely convenient both as a standalone service and as part of the broader ecosystem.
Merchants using “Card on File (CoF)”—a service that allows customers to pre-register and store credit card information on e-commerce sites and apps—are creating member accounts to register cards and expanding features for customers with recurring payments.Even at these merchants, the directory allows for the registration of address information—not just token numbers—so while the card number is retrieved via the token, the Merchant does not need to ask the customer to re-enter their address information. The Credential Directory enables this seamless information sharing.
By using the Credential Directory along with the “Add Card” features in Click to Pay and CoF, customers do not need to enter their card numbers during initial registration—whether at a Merchant they’re visiting for the first time or at a store where they’ve already registered.Subsequent transactions are, of course, processed using tokens, while security during registration is ensured through biometric authentication. This approach guarantees both security and convenience.
Agent-based commerce has been gaining attention recently, but when agents shop on behalf of users, card payment information is required. While some people may feel uneasy about providing their 16-digit card number to AI, paying with tokens from the Credential Directory prevents card number leaks.
Similarly, while we anticipate various use cases emerging in the future, our fundamental approach is to build the foundation for the online shopping experience by ensuring that 16-digit card numbers are never displayed or stored in places where attackers could steal them.
To summarize, Mastercard is making online payments safer and simpler. We tokenize all transactions, so card numbers are neither used nor stored during transactions. We eliminate the need to manually enter card numbers or passwords. This ensures that data can no longer be intercepted. As a result, we enhance security and improve the user experience.In this way, Mastercard will deliver a seamless digital payment experience that balances security and convenience.
Thank you for your attention.
