August 12, 2011

Did Shift4 Really Invent Tokenization?

Several companies claim to have been first-to-market with tokenization. Their evidences and believability vary widely, so while we cannot address the individual claims of our competitors, we can explain our claim and why we’re confident in saying that we invented tokenization and introduced it to the market.

First, let’s establish what exactly it is we claim to have invented. Did we come up with the word “tokenization?” Absolutely not. The term “token” comes from the Old English tacen, meaning “sign, symbol, evidence.” The term evolved until the 1590s when it was first used to describe a “coin-like piece of stamped metal” (like a modern arcade token). It is from this definition – the arcade token – that we derived the term “tokenization” as it pertains to the credit card industry. Tokenization is the process of replacing something of universal value (a quarter in the arcade or a credit card number in our case) with an unrelated token that holds value only within specific parameters.

At the 2005 Security Summit in Las Vegas (to date, the only such event attended by representatives of all the major card brands) we introduced the technology and made it clear that a token should have no relation to the original value except by reference. Arcade tokens are not derived from the quarters they replace and cannot be reversed by alchemy or any other means to again become currency – and so it is with true tokenization.

Those who argue that any replacement of card data (hashing, encryption, etc.) can be considered tokenization may argue that their technologies were on the market prior to 2005. We absolutely agree. Using this definition (which we do not support), it is easy to trace programs back two decades or more; we had a unique user ID reference program in the mid-1980s that fits that description.

Previous to our public announcement to industry experts and representatives of the card brands in 2005, there were no organizations marketing “tokenization” in the payments space. Since that time, as tokenization has grown in popularity and reputation, dozens of marketing teams have applied the term to their existing (or slightly modified) product offerings, trying to take advantage of the groundswell of momentum behind the technology we released and its ability to drastically reduce a merchant’s PCI scope and breach profile. The card brands recognize Shift4 as the inventor of tokenization, as do nearly all the industry experts not biased by allegiance to one of these competing solutions.

Therefore, it is our assertion that we introduced tokenization as it applies to the payments space and that we invented the technology behind it. We chose not to patent that technology, nor copyright the name because we felt it had great promise for the industry as a whole. (Although, looking back, perhaps our altruism allowed for more confusion and contention than cooperation.)

We warn those considering tokenization solutions to avoid weak solutions that do not offer the same simplicity and security as our original offering. Those seeking further information on tokenization should request a copy of our Tokenization Request for Information (RFI) by contacting [email protected].