By: Radi El Haj, CEO at RS2

For all the innovation in retail over the past decade, the moment of money has barely changed. Shoppers who browse effortlessly on their phones, receive personalised recommendations, and enjoy near-instant delivery still find themselves having to halt at checkout, reach for a card, type sixteen digits, and navigate security prompts.

The experience is jarring, and the consequences are measurable. According to research aggregated by the Baymard Institute, around 70% of online shopping carts are abandoned before purchase, a figure that has remained remarkably persistent regardless of how much the rest of the retail journey has improved.

The study’s enquiry into the reasons that people abandon online purchases at the checkout phase shows that a significant share of that abandonment is directly attributable to checkout friction. Although the most common reason for not completing the checkout process is that customers weren’t ready to buy, there are plenty of reasons that are well within the ability of merchants to control through better technology and design. Long or complex processes, mandatory account creation, and repeated card entry all chip away at the consumer’s willingness to complete a transaction. Of course, a level of friction can be useful as it reassures customers that you are taking security seriously.

Payments can’t be completely invisible – not until you have won a customer’s trust anyway. Once a customer is assured that you are safe to deal with, repeatedly entering payments data and remembering logins becomes an impediment to further sales. There needs to be a way to make payments feel invisible (when that’s appropriate) while remaining secure. This isn’t just vital for commerce today, but for a future in which agentic commerce becomes the mainstream.

That is beginning to become a reality, and the technology driving the shift is tokenisation.

How tokenisation powers the invisible checkout

At its core, tokenisation replaces sensitive card data, specifically the primary account number, with a unique digital surrogate that can be used to authorise a transaction without ever exposing the underlying credentials. EMVCo, a technical standards body, defines these payment tokens as values constrained to specific merchants, devices, or transaction types, meaning that even if intercepted, they are functionally useless outside their intended context.

For consumers, the practical effect can be transformative. Once payment credentials are tokenised and stored, subsequent purchases across subscriptions, in-app commerce, chat-based retail, and even multi-merchant bundles can proceed without the shopper ever re-entering their card details. The payment becomes, in effect, invisible.

The appetite for this kind of frictionless experience is growing rapidly. As the Federal Reserve has noted, the rise of embedded and invisible payment systems reflects a broader shift in consumer expectations, one where payments fade into the background of an experience rather than interrupting it. Ride-hailing, streaming, and cashier-free retail have already normalised the idea that payment simply happens. The challenge now is extending that expectation across the wider commerce landscape.

Security without compromise

One of the most persistent misconceptions about frictionless payments is that convenience must come at the expense of security. Tokenisation directly refutes this. Because a token is tied to a specific transaction context, its value to a fraudster is negligible, even if intercepted. Even if they were to achieve the near-impossible task of decrypting the token, it can only be used with a single merchant. According to analysis by Evervault, citing Deloitte research, merchants adopting network tokenisation have seen fraud rates fall by around 26%, precisely because stolen tokens cannot be repurposed for transactions at other merchants or in other channels.

This is reinforced by the broader standards landscape. EMVCo’s technical framework for payment tokenisation is designed to provide end-to-end protection from the point of purchase through to issuer authorisation, a fundamentally different proposition from localised tokenisation that operates only between a merchant and an acquirer. The result is a system that Visa has publicly positioned at the centre of its own strategy for frictionless checkout, recognising that security and seamlessness are not competing priorities but complementary ones. Mastercard have gone even further, announcing the ambitious goal of completely eliminating manual card entry by 2030.

Preparing for agentic commerce

As much as they’re pushing forward with plans for tokenisation, Mastercard and Visa are both going full steam ahead into preparing for fully agentic commerce. The overall idea is simple to understand, but difficult to implement securely: allow AI ‘agents’ to act as personal shoppers, making purchases on a user’s behalf with some level of autonomy – perhaps even complete autonomy.

Under this paradigm, the checkout is truly invisible, as a customer might ask their AI agent to order an item and never see the seller’s website, much less the payment process. They may even grant their agent autonomy to choose which seller to buy from. To enable this, systems like Mastercard Agent Pay will allow agents to prove that they are acting on behalf of a real person when using a particular payment card, with users able to withdraw their consent instantly if something goes wrong.

As of 2024, approximately 70% of global e-commerce transactions already use some form of tokenisation to obscure raw card data, a figure that reflects both the pace of adoption and the scale of infrastructure investment still required to make truly invisible checkout universal. To make agentic commerce, future-proof security, and invisible checkouts a reality, the foundation is tokenisation.