How to Use Card-On-File Data Inquiry
User Experience
High-level user experience and the usage of Card-On-File Data Inquiry by the clients.
Prerequisites
- VAU subscription by issuer is mandatory in order to communicate PAN updates and replacement information to Visa
- Issuer application integrated with Visa Developer Portal to access Card-on-file Data API
- Issuer online or mobile banking application is designed for its cardholders to provide the list of COF Merchants
Application Flow
- Cardholder logs into issuer online or mobile banking application and selects Payment account number to retrieve all relevant COF Merchants
- Issuer submits the Payment Account Number to Visa
- Visa returns COF Merchant details as API response
- Issuer displays list of COF Merchants to cardholder
The following are example data elements that clients will receive from Visa in response to the COF Data API request:
- Cleansed Merchant Name – Name of the merchant where the cardholder stored the card credentials and which merchant initiated the transaction. It is important for cardholder recognition that the name that is used for the merchant descriptor be the name by which cardholders recognize the merchant
- Merchant Category Code – Appropriate merchant category code (MCC) associated with the merchant
- Number of transactions in the last thirteen (13) months – Number of transactions using the cardholder’s credentials stored on file in the last 13 months
- Token Requestor ID – If the merchant is a VTS Token requestor, Visa populates the eleven-digit Token requestor ID (If not, this field will be blank)
- Last Transaction date - Visa populates the date in “mmddyy” format when the merchant initiated the last transaction using cardholder’s account credentials over the last thirteen (13) months
- Update Flag – Visa populates Y or N flag when Visa sent the update to either PAN or Token credentials stored by the merchant in the last thirteen months using Visa Account Updater or Visa Digital Credential Updater
- Update date – If the update flag above indicates that a recent update is made to PAN or Token credentials, Visa populates the date in “mmddyy” format when the most recent update was delivered to the merchant
Participants
This section describes the key stakeholders involved in the service and the benefits that this service offers to each of them. The below figure shows the stakeholders involved in the service utilization.
Card Issuer and Issuer Processor
Card issuers maintain and own the account relationship with the Cardholder, as well as owning authorization and ongoing risk management in the payment ecosystem including providing appropriate consumer disclosures (or obtaining consents) and addressing cardholder data privacy considerations. Issuers obtain information about the merchants who may have the issuer cardholder’s account credentials on file and which merchants received updated account information when the issuer reissues or replaces the account credentials.
An Issuer processor may also submit the request to Visa on behalf of Issuer/cardholder.
Cardholder
Cardholders are issued PANs by the card issuer. Cardholders may store card (PAN) or Token credentials at a merchant, so that the merchant can initiate transactions scheduled or unscheduled at cardholder’s request or so that the cardholder can initiate a transaction without having to input their card details at time of purchase.
In the case of card-on-file Tokenization, cardholders, generally, do not know that a Token has been issued to represent their account. With the user experience that issuers can provide their cardholders, cardholders benefit from increased visibility as to which merchants have their PAN and Token credentials on file, as well as the number of transactions associated with that merchant in the past thirteen (13) months.
Merchant
Merchants may store the PAN or Token credentials when a cardholder initiates a transaction on an electronic commerce website or using a merchant application running on a device. Merchants use those payment credentials to initiate a transaction at cardholder’s request. Merchants participating in VAU receive updated account information from Visa when issuers replace or reissue the cardholder’s account credentials. Additionally, those merchants who are also Token Requestors will automatically benefit from issuers’ lifecycle management changes to update credentials.
Acquirer and Acquirer Processor
Acquirers process transactions (including authorization, capture clearing, and exception processing) for their merchants and send the transactions to payment networks for further processing.Acquirers participating in VAU may request updated account information from Visa on behalf of their merchants.
Visa Developer Platform
Visa Developer Platform (VDP) is a common web portal for partners and developers that provides a single entry point for all Visa Developer tools. VDP is an API management platform to enable development teams to rapidly build and deploy APIs providing ideas and sample codes. The COF Data API will be accessible to issuers, issuer processors, and delegated agents (e.g., issuers may have application vendors to develop issuer applications) through VDP.
Visa Account Updater
VAU is a service designed to address the requirements of account-on-file transactions and to enable the secure exchange of updated account information among participating issuers, acquirers, and qualified account-on-file merchants. VAU supports typical account renewals or card replacements; account upgrades or downgrades; portfolio acquisitions and/or mergers; lost/stolen cards; other account closures; and MasterCard-to-Visa conversions. VAU provides the platform for issuers to communicate the most current changes to cardholder account information through acquirers to merchants whose business models support electronic maintenance of customer account information. Participating merchants use updated cardholder account information to support account-on-file functions, such as recurring payments, subscription services, Internet “one-click” merchants, and preferred customer programs such as travel and entertainment (T&E) Gold cards. VAU is designed to offer an automated, dedicated, and secure clearinghouse to make changes to cardholder account information available in a timely, efficient, and cost-effective manner.
Visa Token Life Cycle Management
Payment Tokens may have various life cycle events like activation, deletion, suspension and reactivation. Token Life Cycle Management is an online web application offered to the clients through Visa Online (VOL) portal. This service enables the clients to manage situations where cardholder devices with payments Tokens are lost, stolen or damaged and a Token status update is necessary. This service can also be used to update the new PAN or PAN expiry date when the cards are reissued to the cardholders.