Ep. 154 - Breaking: Evervault Launches Browser Tokens at Money20/20 USA 2026

Grant Evans (0:05)

Welcome to the show floor at Money2020, USA 2026 I am joined this morning by Shane Curran, co-founder and CEO of Evervault, and we have an exciting breaking news story to launch to Money2020 today. Shane, let's talk about Evervault launching browser tokens so that AI agents can check out on any website without ever seeing your card.

Yeah. Very excited for this launch.

Shane Curran (0:34)

Why is it important? So there's always great work happening in agentic payments. Everybody's inventing new protocols, new ways of making the payment online. That works really important, but the reality is there's been this explosion in personal AI assistance in the past, even two to three months.

People want to use these tools now for the first time to actually do things on their behalf. So booking travel, ordering groceries, all the stuff that you would otherwise spend hours doing on your own, and there's been a lot of approaches to this where everybody expects the entire payments infrastructure of the world to be refilled, and unfortunately, that's just not the case as much as we would like it to happen. People want to use their credit cards, and they want to use their standard existing payment credentials to make these purchases. So a lot of AI agents have been doing is using headless browsers to navigate the web on your behalf, and that then begs the question of, well, how do they get your card data? How do they paste it into the web page and so on, which unlocks a whole world of pain in terms of DCI compliance? How do you do restrictions on merchants, spending controls and so on? And a bunch of different companies like the Card Networks and Open Source Consortiums and so on have been building new technologies for this. But if you break it down simply, there's hundreds or maybe thousands of personal AI assistants today, but there's millions or tens of millions of merchant websites. It's much more likely that the AI agent builders are going to adopt a new technology and kind of adapt to what actually exists in the web already than it is for every merchant in the world to rebuild everything, to accept the agentic payments, which in the long run we think will be very big, but today are still an infinitesimally small percentage of overall transactions.

Grant Evans (2:08)

What's breaking the most at the moment in that agentic world? Like you're rolling out for the first time. Where are we encountering problems right now?

Shane Curran (2:15)

So there's two main parts. The first is compliance, where to actually use these headless browsers, you need a browser platform, like a browser base that we're excited to an insist with.

And you need an LLM provider as well as all the other infrastructure. Unlike traditional technology, where you can kind of neatly compartmentalize everything, so only one part of the stack has access to the card data. They need all of this stuff to touch the raw card data, which just isn't feasible because these platforms aren't PCI compliant. It would be very difficult for them to become compliant as well. So they need a way to be able to use the card, but they'd actually touch in the card information.

The other piece is increasing checkout success. So merchants over the past 20 years or 30 years have spent huge amounts of money and time on building anti-fraud and bot detection technology, which made a ton of sense when bots were seen as bad, but now the bots actually are the people. Getting around anti-bot systems, making sure that checkout is actually successful because if you look at a Instinct or any of these other personal AI assistants, maybe best case you're getting a 50 or 60 percent checkout success rate, or you hit a capture or a fraud block or something similar, and solving that piece is, I think, the bigger usability part that we're very focused on.

Grant Evans (3:28)

For those who don't know, can you actually explain what a browser token is in layman's terms? Yeah.

Shane Curran (3:33)

So a browser token is integrated with the rest of Evervault's platform, where we give developers all the tools they need to encrypt the card data wherever the user is giving it to them. So whether that's in iMessage or on a web page where they're configuring their accounts, that gets encrypted so they no longer have raw credit card data on the right of scope of the PCI.

What Browser Tokens does is it takes that real encrypted credit card number and it generates a synthetic credit card number. So usually the first six or eight digits of the cards tell you whether it's a chase debit card or something similar. We preserve the first six to eight digits of the cards. The rest of it is randomly generated, but we'll still pass all the basic validation checks and so on on a merchant website.