A payment credential is any data, device or combination of the two that lets its holder authorise a payment from an underlying account. The classic example is a card's primary account number together with its expiry date and security code. Others include a network token stored in a phone wallet, a bank account and routing number used for direct debits, a virtual card number, and the login and approval steps for an account-to-account payment. Credentials differ in how much they reveal: a token or virtual number can be limited to one merchant, amount or device, while a raw card number can be reused anywhere until the card is cancelled. Because stolen credentials drive much payment fraud, industry standards aim to minimise where real credentials are stored and to pair them with strong authentication. Also see card-on-file transaction.