Visa Inc. and MasterCard Inc. ﻿ are taking long-awaited next steps to ramp up security of customer data as concerns over cyberattacks continue to mount.  The plans, unveiled separately by the world’s largest payments networks, include the expansion of tokenization—a way to obfuscate a customer’s information during a transaction—and biometrics verification.  The announcements come as President Barack Obama and a large group of government officials descended Friday on Stanford University to meet with top executives from a number of industries, including Apple Inc. Chief Executive Tim Cook , for a first-of-its kind cybersecurity “summit,” part of an effort to combat future cyberattacks.  Concerns over cybersecurity are growing as high-profile data breaches have hit nearly every corner of corporate America—from retailers like Target Corp. , to Sony Pictures Entertainment, to J.P. Morgan Chase & Co., to most recently health insurer Anthem Inc.  Visa and MasterCard, which handle transactions for companies and are looked to for guidelines on protecting customer data, have managed to emerge from these scandals relatively unscathed, according to Gil Luria, an analyst at Wedbush Securities.  “Part of their role, part of what they charge for, is setting the rules of the road and enforcing them,” said Mr. Luria. “What hasn’t happened yet is that there’s been very little blame put at Visa and Mastercard’s doorstep.”  Visa said it would bring its Visa Token Service, which replaces cardholder information such as account numbers and expiration dates with a unique series of numbers that validates the customer’s identity, to device manufacturers beyond Apple. Visa launched the service on Apple devices in October, allowing users to wave an iPhone in front of a wireless reader and complete the transaction with a fingerprint.  Visa said it also plans to tokenize online transactions for retailers that use its Visa Checkout service, including Gap Inc. and Orbitz Worldwide Inc.  By getting rid of the sensitive card information, banks and merchants can leave hackers with nothing of value to steal if they break into their computer servers.  “Removing card account numbers from the processing and storage of payments represents one of the most innovative and promising technologies we’ve seen in decades,” said Visa Chief Executive Charlie Scharf in a news release.  MasterCard, meanwhile, said it plans to spend more than $20 million on its efforts, which include a pilot program to be rolled out later this year that will use a combination of biometrics, such as facial and voice recognition and fingerprint matching, to authenticate and verify transactions.  MasterCard said it would also continue to push forward with the rollout of chip cards.  The company teamed up with Visa last year to form a new group to speed up the adoption of technology aimed at improving credit- and debit-card security, including the use of chip technology in credit and debit cards. In chip technology, which many countries have already implemented, the magnetic strip found in credit and debit cards is replaced by a smart chip that stores customer data.  U.S. banks and retailers have dragged their feet on implementing new payment systems because it requires significant investments in new payment technologies.  It is estimated that half of all cards will be chip-enabled by the end of the year, according to MasterCard. Both Visa and MasterCard had originally set an October 2015 deadline for retailers to adopt the chip technology, known as EMV.  Still, Mr. Luria questioned whether the initiatives would be enough.  “Nobody’s really come up with a foolproof way to safeguard consumer information,” he said. “At the end of the day, it’s the retailer, the bank that has to keep it secure. [Visa and MasterCard] can only do so much to set the rules, enforce them.”  Write to Chelsey Dulaney at Chelsey.Dulaney@wsj.com
Visa and MasterCard unveiled plans to ramp up cybersecurity features for online transactions, amid growing concerns over credit-card theft.