Invisible payments are reshaping how we buy, sell and engage, often without us realizing it. On Behind the Checkout, Gr4vy’s podcast, John Lunn, Founder and CEO of Gr4vy, talks to Colin Luce, CEO and co-founder of Basis Theory, a pioneer in tokenization and secure data infrastructure, about what’s driving the rise of invisible payments, the risks merchants need to navigate, and what’s next for frictionless commerce. The conversation below is lightly edited for clarity.
Key insights from the episode
Colin Luce is CEO and co-founder of Basis Theory, a pioneer in tokenization and secure data infrastructure with deep expertise in payments, security and privacy.
John Lunn is Founder and CEO of Gr4vy, the cloud-native payment orchestration platform.
John Lunn: Colin, welcome to the show. Great to have you here.
Colin Luce: Thank you. Make tokenization great again, John.
John Lunn: Absolutely, we agree on that point. Let’s kick off: when we talk about invisible payments, what do we really mean, and are they already part of our daily lives?
Colin Luce: For sure. Some of the more interesting aspects of invisible payments actually run counter to the name of this show, because I think they happen in front of the checkout. Behind the checkout, at least from a consumer perspective, all of payments, the flows, the data and the parties, is already invisible. Some of our fellow payment nerds watching will say, no, there’s this complex multi-party model and so on, but from a consumer perspective, behind the checkout it’s already invisible.
When we talk about in front of the checkout, I was thinking about this after our prep chat. I tend to use historical context, and I immediately went to the late nineties, when Amazon patented one-click checkout. For all intents and purposes, that was the first time people experienced what invisible payments could look like, and ever since, we’ve been cascading closer and closer to truly invisible payments. In the early 2000s, after Amazon’s one-click, we saw the rise of stored payment methods, card on file and so on.
Fast-forward to the mid-2010s, when Uber launched, and I’m sure you played a role in that when you were at PayPal and Braintree. They were the first to take it a step further. I so vividly remember the first time I got out of an Uber and immediately got the receipt emailed to me, with no confirm this or anything.
John Lunn: Did you feel a bit like a criminal at that point? I felt like, oops, maybe I just walked out of the store without paying.
Colin Luce: I remember feeling euphoric, but maybe I’m a sick criminal and those are the same feeling for me. There have been a whole host of other attempts at this, with some of the one-click checkouts, and we don’t have to get into their successes or failures. But more recently, there’s the success of Stripe Link. That’s the most recent time I had a similar experience, and Shop Pay is another example. Moving from one click to zero clicks is the acceleration of invisible payments.
“How can we move from one click to zero clicks is kind of the acceleration of invisible payments.”
Colin Luce, CEO and co-founder, Basis Theory
John Lunn: I think the ultimate goal here is zero clicks, where it just happens. I always joke that no one enjoys paying for stuff. The worst part of the shopping experience is the paying bit, so let’s make it vanish.
Colin Luce: And we’re so accustomed to it with all the subscriptions we sign up for across our digital lives, and increasingly our physical lives, whether it’s pet food or toilet paper. It’s funny you mention zero clicks, because I was using that historical progression and thought, what comes after zero? The only thing after zero is negative, and that’s where I started thinking about AI. Maybe the negative-click experience is us declining transactions that are being proactively attempted on our behalf, as opposed to zero clicks. But then I went down some weird rabbit holes.
John Lunn: I guess you get the refund before you’ve asked for it. Maybe that’s minus one.
Colin Luce: But there’s something there.
“Maybe the negative click experience is us declining transactions that were being proactively attempted on our behalf.”
Colin Luce, CEO and co-founder, Basis Theory
John Lunn: Absolutely. There are technologies behind this. Tokenization is obviously close to our hearts, but there are also biometrics and connected devices. How do they all work together to truly make payments disappear?
Colin Luce: I’ll say it again, because it’s my stump speech: make tokenization great again. But you’re right. Going back to what we were just discussing, the Amazon one-click experience and the Uber experience are all predicated on tokenization under the hood. On your point about biometrics, and further deployment of this technology for authentication and identity, I think in a world of AI and agentic commerce it’s only going to become more important and critical, to build the trust you were just talking about, so consumers don’t feel like criminals.
The beauty of tokenization from a technological perspective, relative to encryption, is that you can apply much more flexible token formatting and use hashes of the data to do things you couldn’t with a standard encryption block. Some of the virtual card solutions, like Visa Intelligent Commerce, apply a 16-digit token as a virtual card to facilitate transactions with parties that aren’t set up to receive tokens directly. So tokens can serve as an intermediary.
There’s also the ability to apply a permissioning layer on top through tokenization, where you can get granular, programmatic and dynamic about authorization and identity. That could be biometrics, passkeys or other methods, where a human, a device in a human’s hand, or an agent acting on behalf of that human might need to say, dynamically: to access this system, I need this piece of information, but do I have the right permissions? Not to get old-school enterprise on us, but it’s almost like applying RBAC policies to identity, authorization and payments, and you can do all of that programmatically through tokenization.
“It’s almost like applying RBAC policies to identity, authorization, payments, et cetera. And you can do all that programmatically through tokenization.”
Colin Luce, CEO and co-founder, Basis Theory
John Lunn: I often find myself wincing when I give my kids my credit card to pay for their bubble tea. No one ever checks; it’s a 13-year-old with a Chase Preferred card paying at a counter, and no one even looks: fine, beep, off we go. In old feudal Britain, you’d hand permission to your servants to go and do your shopping, and we’re getting to a world where you say, this agent is permitted to use my payment details to buy items, and you end up with an army of bots you’ve provisioned. That gives me a bit of a headache. Every time I find a rogue subscription for something I ordered drunk on the sofa on a Friday night, a year later it’s, congratulations, thank you for renewing your $700 subscription. It gets even worse with agents doing things for you. So tokenization is hugely important here, and the big missing layer for me in agentic is that authorization or authentication doesn’t seem to be top of mind for people at the moment.
Colin Luce: On both sides of that: granting access and revoking access, to your point. How do you stop your kid going out and buying this? You’d have to drive there and grab the card from them. Revoking access is just as important as granting it.
“The revoking of access, I think it’s just as important as the granting of access as well.”
Colin Luce, CEO and co-founder, Basis Theory
John Lunn: Exactly. There’s always a balance. Earlier in my career, I’d sit down with merchants who’d say, I need you to reduce my fraud to zero. And I’d say, fine, I’ll just switch off your payments. There’s a line between frictionless and risk. How do we preserve security without introducing friction?
Colin Luce: I think it depends heavily on who the “we” is. We were just discussing this internally: at the end of the day, all of payments is a balance between risk and fraud on one side and authorization and acceptance on the other. And a new dynamic has been introduced through wallets, network tokens and things like 3DS: the concept of liability shift. Liability shift sounds fantastic on the surface, but what does it actually mean? It becomes a game of hot potato, where no one wants to take the risk. If we turn this into a liability shift mechanism, that’s inherently going to drive down auth and acceptance, because no one wants to take on the risk.
“Liability shift is one of these things that on the surface sounds fantastic… It becomes this game of hot potato, right? No one wants to take the risk.”
Colin Luce, CEO and co-founder, Basis Theory
So, to your point, it’s a constant juggling act, but the perspective of “we” matters most. As a consumer, I’m not sure how much I care. If it’s a fraudulent transaction, I’ve got a 1-800 number on my phone, I call my credit card company, they immediately say don’t worry, we’ll take care of it, and magically the next day there’s a new card in my inbox. For merchants, it varies a lot by what they’re selling. If you’re selling a digital subscription with 95% gross margin, you want as much through the funnel as possible, and the highest possible fraud threshold, because your margins are so high. If you’re selling commodity t-shirts at a 10% margin, you want much tighter controls. And the issuers want the least fraud of all. So the “we” matters. I’m curious how you see it.
John Lunn: Culturally, it’s really different. I’m originally from Europe, and in Europe your bank very much teaches you that it’s your problem. The US attitude is, it’s not my problem, I’ll just call the 1-800 number and get a new card. In Europe, they literally drill it into you: don’t let anyone have your card. And they make it enough of a headache for you that it’s not worth it.
Colin Luce: And we’re so fat and happy with all the rewards. They shove it down our throats: give your card to anyone, spend as much as you want, and if it’s fraudulent, we’ll take care of it and push it onto the issuer. That’s a very astute observation. It’s a very different culture, and I think it cuts across our spending habits and our use of credit in payments far more broadly than what we’re talking about.
John Lunn: Apple, perhaps begrudgingly, is now enabling external payment links in iOS apps; they were kind of forced to by Europe. So we’re seeing doors open for more flexible, background-style transactions. Does this signal a broader trend toward invisible payments? Are we breaking down the walled gardens? And how do merchants engage customers outside the checkout flow that’s been around for the last 10 years? How is this changing?
Colin Luce: I don’t know. I actually think the in-app buying experience is about as invisible as it gets from a consumer perspective. It’s a lot closer to the Uber experience we discussed. So from a consumer perspective, I think we’re going in the other direction in some ways: it’s going to be less invisible, as per the courts. They think this will be better for merchants, but from a consumer perspective, I’m not sure that’s the case. If it plays out the way people think it will, and I think it will, Apple will somehow find a way to make up for it, so I don’t feel bad for them, and nor should anyone. There are also companies with vertical focuses, on gaming and so on, that have already built some of this. Do they become the de facto checkout processor for people not using Apple? With everything, there’s a power law toward two or three companies, and I think that’ll happen. But it could be less invisible from a consumer perspective.
John Lunn: My view on Apple is that, whether you believe it or not, the argument has always been that keeping things within the walled garden is more secure, safer and a better consumer experience. But my gut feeling is they’ve got so much ubiquity within the ecosystem that it’s a bit like PayPal. People still religiously use PayPal even when other options might be quicker or better, because they’ve always used PayPal and will keep using it. I think that’s even more true of Apple in its ecosystem. Most people won’t change.
Colin Luce: Maybe it all comes back to Apple in a weird way. I’m not going to pay with my card on file in iTunes or the App Store, so the app I’m buying through sends me to its third-party payment provider, which supports Apple Pay, and I end up paying with the card on my phone through Apple Pay anyway. Maybe in a weird world it all comes back to Apple, which probably reinforces the court’s decision, but I don’t think they’ve thought through steps two, three and four.
I find myself increasingly using Google Pay and Apple Pay as much as I can, Apple Pay for me. Apple Pay launched on desktop recently, and I remember being on a panel a few months ago saying, this is ridiculous. You’re telling me the user experience of buying with Apple Pay in a desktop browser is that I have to use my phone’s camera to scan my computer? It felt so cognitively dissonant from the AI conversation about robots taking over, and here we are taking pictures of our computers with our phones in this hyper-analog way. Then, a couple of weeks ago, I bought something with Apple Pay on my phone through a desktop, and it was actually kind of nice. It’s weird, but it’s kind of nice.
John Lunn: I suppose it’s three factors, and maybe that helps.
Colin Luce: Totally. I thought, if someone takes a picture of me taking a picture of my computer, that’s a meme waiting to happen. But the actual experience was fun.
John Lunn: I find myself signing up for apps like Rocket Money, because I forget where the hell I’ve put my credit card and what I’ve subscribed to. Part of invisible payments is that my payment details, whether tokens or not, are stored all over the internet with merchants big and small. There are lots of rules about who you should give your card to, but even I accidentally end up on websites thinking I’m getting a great bargain on a pair of alpaca socks, and it turns out to be some random fake site. What do frictionless payments mean for consent and privacy? I give my consent right at the beginning, and from then on I don’t know where my card is sitting. I only really find out when something goes wrong. How should we change this? Is it the Visa and Mastercard approach, where you go to your bank account and cancel subscriptions from there, or is there a better way?
Colin Luce: As you know better than anyone, judging by our dialogue on stage a few weeks ago, the last people I want to give more power to in this ecosystem are the networks. That said, I actually think this is an area where the networks need to step up. When we were first starting Basis Theory and thinking about marketing gimmicks to drive awareness of tokenization, one service I wanted to build was a consumer application where you give us your credit card, and we call the networks and say, tell me every merchant where this card is tokenized. You wouldn’t get the details that something like Rocket Money gives you, about what it’s tokenized for or whether there’s a subscription attached, but just knowing where it’s tokenized would be a fascinating start.
“We call the networks and say, tell me every merchant where this card is tokenized at.”
Colin Luce, CEO and co-founder, Basis Theory
I imagine Europe will move much faster on this, given how it’s moved on open banking. But I think it’s a service the networks should offer, because I don’t think it inherently gives them more power in this ecosystem. For consumers, it’s a combination: show me everywhere my card is on file, whether there’s a subscription attached or not, and I’ll reconcile that with my transaction history and work backward. That’s what I’d love to see the networks offer. I went and talked to them about it, and they said, yes, we could definitely do that, but you’d have to get consent merchant by merchant to share it. That defeats the whole point; of course I’m not going to be able to do that. So that’s an area where the industry could step up.
John Lunn: I think it’s actually happening. I’ve seen demos from one of the card schemes; it’s definitely on their roadmap. You log into your online bank, see everywhere a token has been issued on your card for a recurring transaction, and you can cancel it.
Colin Luce: But that might only be where a network token has been created. The level beyond that would be wherever a merchant-initiated transaction has been made on my card, whether or not a network token was provisioned. You hear Visa say 50% of its transactions last year were tokenized, but that’s a bit misleading, because a lot of those network tokens are provisioned behind the processor or acquirer, and the consumer never knows. They’re not independently issued network tokens.
John Lunn: I think there’s an opportunity, though it might be a little scary for merchants doing subscriptions. If you’re providing a service and you go to bill a consumer, only to find they’ve already cancelled it at the bank…
Colin Luce: There have been attempts at that, less on the payments side and more through the FTC, and I think Adobe was the canonical example. You can go at it from the payments side, or from the business model side through the FTC, and Adobe has been on the wrong side of that. That’s another path: saying to businesses, show us your subscription management practices, rather than approaching it from a payment permissions perspective.
John Lunn: I saw a stat, not quite 90% but getting close, about the share of subscriptions people forget about. It was extremely high. A lot of money is being made in the subscription market from subscriptions that are effectively dormant: people aren’t using the services, but they’re still paying. It’ll be interesting to see how that plays out. And look at the usage-based models rising in subscriptions, like most AI tools, where you top up the meter and off you go. That could be a problem: if you’re busy running up usage and the customer has cancelled in the background, we’ll end up back in the 90s with chargeback-style problems.
Colin Luce: Technology cycles always do this. They ebb and flow and go too far in one direction. Maybe we’ve gone too far in this direction and the pendulum will swing back, and hopefully not too far. I got an email a couple of weeks ago saying my United WiFi subscription is no longer supported, because they’re moving to Starlink with more of a pay-per-flight model. So there’s increasing evidence of a shift from subscriptions to usage-based models, just as B2B software has shifted from per-seat to consumption models.
John Lunn: I see it slightly differently at the moment, because almost everything you buy seems to come with a subscription these days. My wife says the last thing we need in our lives is another subscription, and she’s right. Every day there are parcels arriving for some random subscription I signed up for at some stage.
Colin Luce: Even your car has a subscription now.
John Lunn: Absolutely. Wasn’t it BMW getting you to subscribe to warm seats? That was pretty awesome.
John Lunn: On that note, are there markets or industries where you think invisible payments make more sense, and any where they make no sense?
Colin Luce: Again, I always go back to perspectives: who we’re looking out for, and from what angle. Putting that aside, I think commodity goods and necessity goods are inherently logical places for invisible payments, meaning subscriptions. The mistake we made is applying the invisible, frictionless payment experience to non-essential goods, things that just jack up our serotonin. That’s where we’ve got into trouble, and where people get into credit card debt: the Instagram buying, the highly targeted stuff. No, I don’t need that ridiculous hat, but if it’s just one click, of course I’m going to buy it. So essential commodity goods are the obvious place for it, because those are things you’ll buy regardless.
“Commodity goods, necessity goods are inherently logical places for invisible payments.”
Colin Luce, CEO and co-founder, Basis Theory
If we take a societal or humanitarian view, maybe we should introduce more friction on things you don’t necessarily need. That makes sense to me. But I’d bet a majority of e-commerce subscriptions, at least, are in that camp. And as a society, do we want to take a GDP hit right now? If you listen to the pundits, they’d say no. So there are many factors. Not to dissuade people from trying, but I think that’s an issue.
The other aspect: we’ve been talking a lot about cards, which are near and dear to my heart, but we should also talk about APMs. Taking a global view, there are many regions, whether India, Brazil or even Europe, that are much less card-based. As UPI, Pix and other APMs move toward a push-and-pull model rather than just push, they’re set up nicely to become the equivalent of a card on file, at least a credential or instrument on file, and therefore invisible payments. I know you at Gr4vy deal much more in the APM world, so I’m curious about your perspective, but that’s an area to look at in this context.
John Lunn: If you haven’t seen the Pix recurring model, it’s beautiful. I look at it with my old PayPal hat on and think, I wish we’d built that. What we built made total sense at the time, but now there are smoother, nicer ways to do this, and there’s definitely an opportunity. But as a payment orchestrator, and you guys do payment orchestration as well, I think it adds a whole layer of complication back onto the merchant. Without an orchestration layer, you’re dealing with very different models. All the agentic announcements are great, but there are three different models. Is a merchant really going to integrate three different ways, and know whether it’s a Mastercard or a Visa card and which one to use? Orchestration has to step in at that point, because there’s no way a mom-and-pop website can do that, let alone the really big merchants; it’s a lot of work. Everyone’s talking about how great it is that AI agents can work with payment companies, but no one’s really talking about how this will help merchants, whether merchants even want it, or who will do the heavy lifting, which is essentially the merchants. That’s the part that isn’t ideal at the moment.
“No one’s really talking about how this is going to help the merchants or do the merchants even want it.”
John Lunn, Founder and CEO, Gr4vy
Colin Luce: And where are they going to keep all their stablecoins? In wallets they’ll self-host and manage?
John Lunn: Exactly, in the stablecoin wallet, of course. It’s interesting: there’s a bit of a backlash against social media at the moment, with a lot of studies on the damage it does to kids. In North America and Western Europe, at least, the social networks have so far failed to build their own payment systems. Facebook has had three or four goes, and it hasn’t really taken off. But now you’ve got Elon with X; he stated that he bought X to turn it into a bank, essentially. That would be invisible payments within the X environment. Is that dangerous, do you think?
Colin Luce: It is, from the perspective I just described. If that’s where I’m being shoveled all of that stuff and it’s also my payment method, that seems like a recipe for disaster. Social isn’t where I’m being pitched commodity necessity goods; it’s where I’m pitched ridiculous funny hats and shirts. So from that angle, it’s bad. That said, I haven’t researched it closely, but the super apps in Asia, which combine your financial life with social media, seem to be a generally good thing for those citizens. So the answer is I don’t know. What I would say is that rather than focus on where we are today, given the speed at which technology is moving, we have to look at tomorrow, and that seems to be ChatGPT and Perplexity. The fact that they’re racing toward this says it’s happening regardless, whether it’s a good, bad or scary thing.
John Lunn: That brings us to the last question we always ask: what’s next over the next five years for invisible payments? Are consumers going to revolt and say, no more, make it visible again?
Colin Luce: It’s going to be a consumer bailout from all the subscriptions and funny shirts they bought. I do think that’s the case. All the examples I’ve heard about agentic commerce, however altruistic and amazing they sound, like helping you be less reliant on the Amazon ecosystem, are fine, but I don’t think we’re talking about the risks as much as we should. So I think it’s a bit scary. That said, I’m fundamentally a technology optimist and accelerationist, so I don’t say that to mean let’s slow down. I just say let’s go into it with eyes wide open. And I think you’re of a similar view. I really appreciate the way you’ve been speaking up for merchants in this, and about the need for identity and authorization. We need more pragmatic voices in the industry saying, we don’t want to slow this down, we just want the right guardrails and controls in place. That seems like the right approach.
“We don’t want to slow this stuff down. We just want to put the right guard rails and controls in place.”
Colin Luce, CEO and co-founder, Basis Theory
John Lunn: We talked about liability shift, but don’t just kick the can down the road. Let’s do this right to start with, rather than moving the problem to someone else so we can all move quicker. That’s never the right way to do anything.
Colin Luce: As much as we’ve talked about agentic commerce and empowering agents, if you watched Visa’s product launch, at the end of the day it’s still very much human in the loop. It’s not a fully automated, truly invisible thing. It can make buying much more efficient, but ultimately it comes back to the user: just quadruple-checking, are you sure you want to book this flight? That gives me some hope that the pragmatic builders in this space recognize it won’t be a free-for-all where we give agents power of attorney, or the equivalent, to transact on our behalf. I think we’ll still be in the loop. I’m optimistic the efficiency gains will free up our time for something else, and hopefully we won’t just move that time to TikTok, to your point about social media, but do something more productive with it. I just tend to be optimistic about this stuff.
John Lunn: I’m definitely optimistic about it. As a payments nerd, I look at this and get excited by the tech. But having seen where it goes wrong over the last 20 years of my career, I think we can do it in a way that benefits everyone.
Colin Luce: That’s why I’m glad you’re building in this space right now, John. You have the experience, you’ve seen what’s gone wrong, but you’re an optimist. I’ll speak for the industry and say we’re glad you’re building.
John Lunn: I appreciate it. Thank you very much, Colin, for coming on the podcast today.
Watch more conversations with payments leaders in the Behind the Checkout series. To see how a payment orchestration platform brings cards, wallets, network tokens and local payment methods together through a single integration, talk to the Gr4vy team.
Pay by bank, also known as bank-to-bank, account-to-account or open banking payments, is evolving fast…
From Apple Pay and Google Pay to Click to Pay and PayPal, a new wave…
In the first episode of Behind the Checkout, Gr4vy's podcast, John Lunn, Founder and CEO…
Q3 2026 at Gr4vy was about giving merchants more control over how they take payments…
A payment orchestration platform connects you to multiple payment providers through one integration and routes…
Credit cards lead Canadian payments at 43%, with Interac debit at 25% and e-Transfer rising.…