Payment Account Reference (PAR)

A payment account reference (PAR) is a unique, non-financial identifier assigned to a card account and shared by the card's primary account number and every token linked to it. It allows a merchant, acquirer or processor to recognise that a physical card, a phone wallet and a card stored on file at a website all belong to the same underlying account, even though each presents a different number at checkout. A PAR cannot be used to make a payment.

PAR was defined by EMVCo, the technical body owned by the major card networks, as part of its work on payment tokenisation, and was introduced in 2016. It became necessary because network tokenization replaced card numbers with many different tokens, which broke merchants' ability to link transactions to a customer. The PAR is assigned under the authority of the network or other entity that controls the card's BIN range.

Imagine a person who uses a passport, a driving licence and a work badge, each with a different number. A receptionist who sees only the numbers cannot tell that the three belong to the same person. Now imagine each document also carried a small reference code that is identical on all three but cannot be used to open any door.

The PAR is that shared reference code for a card account. The card number, the phone wallet token and the online token all carry it, so a business can tell they are the same customer's account without ever needing the real card number.

A PAR is an alphanumeric value of up to 29 characters. Its first four characters identify the BIN controller, the entity responsible for the BIN range, and the rest is a unique value. It is generated so that the card number cannot be derived from it. The PAR is created when an account is first tokenised or when the issuer enrols, and it is returned to acquirers in authorisation responses and to token requestors when tokens are provisioned. Issuers can keep the same PAR when a card is reissued with a new number, which helps preserve the link over time, much as a card account updater preserves stored credentials.

• Transit. Open-loop transit systems use the PAR to recognise that taps with a plastic card and with a phone wallet belong to the same account, so fare capping and journey history work across devices.
• Loyalty and receipts. Retailers can link purchases to a loyalty profile, or find a receipt for a return, without storing card numbers.
• Fraud and risk. Fraud teams can spot when many tokens or cards trace back to one account, supporting fraud detection.
• Analytics and customer service. Merchants can analyse customer behaviour across payment channels and identify a customer during disputes.

A simple example shows the value. A commuter taps a plastic debit card at a ticket gate in the morning and, having left the card at home, taps a phone wallet linked to the same account in the evening. The two taps carry different numbers, the card number and a device token, so without PAR the transit system would treat them as two separate travellers and might charge two full daily fares. Because both taps return the same PAR, the system recognises one account, applies the daily fare cap once and shows both journeys in the customer's history.

A network token is a payment credential that can be used to pay within its domain; the PAR is only a reference. A token service provider maintains the mapping between the PAN, its tokens and the PAR, and token requestors such as wallets receive the PAR when they obtain tokens. Because the PAR cannot be used to derive or initiate a payment, it reduces the need for merchants to keep card numbers in their systems, which can shrink the scope of PCI DSS obligations. Merchants should still treat it carefully, since it identifies a customer's account and may count as personal data under privacy laws such as the GDPR.

Support for PAR depends on issuers, networks, acquirers and terminals all passing it through, and coverage has grown gradually since 2016 rather than everywhere at once. Merchants that rely on it must handle transactions where no PAR is present. A PAR is linked to an account, not a person, so a customer with cards from two banks has two PARs, and a closed account cannot be linked to its replacement at a different bank. Some processors still do not expose PAR to merchants, which limits its use in practice.

• EMVCo