Card provisioning is the process by which a payment card is set up for use in a digital form, most often inside a mobile wallet on a phone or watch. During provisioning the real card number is exchanged for a substitute value, a payment token, which is stored on the device and used for payments from then on. The issuer of the card decides whether to allow each request.
The process is built on the tokenization framework published by EMVCo and operated by the card networks. It is the step that links a card to a digital wallet, and its security matters because a card provisioned to a criminal's phone can be spent like the original. The word is also used more loosely for delivering any new card credential to a customer, for instance issuing a virtual card instantly at account opening.
Parties involved
Four roles take part. The token requestor is the entity asking for the token, typically the wallet provider or a merchant storing a card. The token service provider, usually the card network, generates the token, keeps the mapping between it and the primary account number in a secure vault, and translates between the two during transactions. The issuer approves or refuses the request and is told of the result. The cardholder initiates the request and, where asked, proves identity.
Steps in provisioning
In the common case, a cardholder opens the wallet and enters the card details by typing, by photographing the card or by tapping it against the phone. The wallet encrypts the details and sends them, with information about the device and the wallet account, to the card network. The network checks that the issuer participates and forwards a request to the issuer, including risk indicators supplied by the wallet.
The issuer validates the card number, expiry date and security code, applies its own risk rules and returns one of three decisions, which the industry labels by colour.
- Approve (green path). The card is provisioned immediately with no further step.
- Require authentication (yellow path). The cardholder must complete an additional check, such as a one-time password sent by text message, a login to the bank's app or a call to the bank.
- Decline (red path). The request is refused.
On approval, the network creates a token tied to that device and wallet, and delivers it with cryptographic keys to secure storage on the device. The issuer's app and the wallet show the card as ready, with the last digits of the token sometimes called a device account number.
Methods of starting provisioning
Manual entry in the wallet is the original method and the one most exposed to misuse, since anyone holding stolen card details can attempt it. Push provisioning starts from the issuer's side: a customer already logged in to the bank's app presses a button, and the app passes an encrypted card payload to the wallet. Because the customer has authenticated to the bank, the issuer can usually approve at once. When this happens inside the issuer's mobile app it is called in-app provisioning. Issuers can also push cards to merchants and other services to be kept as a card on file.
Paying with a provisioned card
In a shop, the phone transmits the token and a one-time cryptogram to the terminal by near-field communication. The transaction is routed to the network, which verifies the cryptogram, swaps the token for the real card number and passes the authorization to the issuer. The merchant never receives the underlying number. Each token is restricted to its device or merchant, so one that is stolen cannot be used elsewhere.
Fraud risks
Soon after mobile wallets launched in the mid-2010s, criminals began loading stolen card details into wallets and persuading issuers' call centres to approve the yellow-path check with stolen personal data. More recent schemes trick victims by phishing into reading out the one-time code sent during provisioning, which lets the criminal complete the enrolment on a phone under their control and spend in shops by tap, far from the victim.
Issuers have responded by treating provisioning as a high-risk event comparable to an account takeover attempt. Measures include step-up authentication inside the bank's app in place of text messages, wording in the message that states what the code will do, scoring based on device and account history, limits on the number of devices per card, and alerts to the cardholder whenever a card is added to a wallet.
After provisioning
Tokens have their own life cycle, separate from the plastic. Through token lifecycle management an issuer can suspend, resume or delete a token on one device without affecting the card or other devices. When a card is renewed or replaced, the issuer updates the mapping in the vault so that the token continues to work, which is one reason wallet payments are less disrupted by reissue than stored card numbers are.