Click to Pay: bye-bye credit card number

How does Click to Pay work?

Click to Pay is the catchy name of a new process that is set to become established in German online retail in 2023. Unlike Apple Pay, for example, Click to Pay is not a visible wallet that is installed as an app on the smartphone and presents the integrated cards with one tap. Rather, Click to Pay is a functionality. Once a card has been activated and connected to the device when making the first payment, Click to Pay automatically loads all the necessary details in the background when the next purchase is made.

Manual input is no longer required. Instead, the integrated device recognition functionality is used for this purpose. For authentication, as required by the European Payment Services Directive PSD2, the device’s method, such as the smartphone’s facial recognition feature, can be used.

This enables a true one-click checkout, with all data remaining in the background – perfect for a smooth shopping experience.

A scheme token provides security

On top of all that, the level of security is even higher than that of the credit cards currently in use, which are already highly secured. The reason for this is a so-called scheme token. A token as such is just a random replacement number for the original PAN (Primary Account Number), i.e. the 16-digit card number^.[1]

Scheme tokens represent a further development of this principle as they contain not only the actual card number, but also the expiry date and the CVV (Card Verification Value) code printed on the card’s back. The data set also includes a digital copy of the card image so that customers can visually recognize their card. A cryptogram complements the security features; it changes from transaction to transaction, rendering the token useless for fraudulent purposes even in the unlikely event that someone were to decrypt it.

Unlike previous tokens, the new generation also includes device binding, which makes it easier to recognize the token and more difficult to use it on unauthorized devices. Another special feature of scheme tokens is that changes, such as a replacement of the card after the expiry date, are communicated between the card-issuing bank (the issuer) and the card network, so that the card does not have to be re-registered in the customer’s account at the merchant.

The girocard is left out

Click to Pay is a development of EMVCo, a joint venture of the major card companies. This means that Visa, Mastercard, American Express and Diners/Discover debit and credit cards will be accepted on a reciprocal basis, while the German girocard is left out. Cards are registered either through a special section on the card brand’s website or through the user’s bank.

“Click to Pay with Visa” has been available to Computop merchants since spring 2021, and other payment service providers are currently joining in. The rollout of the new method by the four major US card brands, which is expected to be finished by 2023, completes the offering for online stores, so we can expect Click to Pay to become increasingly visible in e-commerce. After all, paying by credit card has never been easier.