Payment Tokenization

Payment tokenization is the practice of replacing sensitive payment data, most often a card's primary account number, with a substitute value called a token. The token can be stored and passed through systems in place of the real data, while the link between token and card number is held securely by a token provider. If a token is stolen, it cannot be used to make payments outside the merchant, device or channel for which it was issued. Card networks, issuers, payment gateways, mobile wallets and merchants all use tokenization to reduce fraud and to limit where real card data is exposed.

The general concept of tokenization is used in many fields, including crypto, where "tokenization" means representing assets on a blockchain. In payments it has a narrower meaning: protecting payment credentials. Payment tokens should also be distinguished from encryption, which scrambles data that can be decrypted with a key; a token has no mathematical relationship to the card number and can only be reversed by looking it up in a secure vault.

There are two main families:

• Gateway or acquirer tokens. A payment gateway or processor stores the card number in its token vault and gives the merchant a token to keep on file. The token works only with that provider, so the merchant can charge the card again without holding the number itself.
• Network tokens. Card networks issue tokens that replace the card number across the payment system. A token service provider, usually the network, creates the token at the request of a token requestor such as a wallet or merchant, and the issuer approves it. The token is restricted to that requestor and channel. This approach, described under network tokenization, follows a framework published by EMVCo.

When a cardholder adds a card to a mobile wallet or a merchant enrols a stored card, the requestor sends the card details to the token service provider. After the issuer approves, the provider returns a token that looks like a card number but comes from a separate token range, along with information about where it may be used. For each payment, the requestor sends the token together with a one-time cryptogram that proves the transaction is genuine. The network looks up the real card number, passes it to the issuer for authorisation, and returns the token in the response, so the merchant never sees the underlying number.

To link tokens and cards for fraud monitoring and loyalty, networks also assign a payment account reference, which stays the same across all tokens for one card account.

• Security. Stolen tokens are of little use, because they are bound to a specific merchant or device and require a cryptogram for each payment.
• Reduced compliance scope. Merchants that store only tokens shrink their cardholder data environment and the work needed to comply with the Payment Card Industry Data Security Standard.
• Higher approval rates. Issuers tend to trust tokenised transactions more, and network tokens can be updated automatically when a card is reissued, so payments to subscriptions continue without interruption. This works alongside card updater services.
• New payment experiences. Mobile wallets, smartwatch payments and one-click checkout rely on device or merchant tokens.

The best-known use is mobile wallets, in which a card added to a phone is replaced by a device-specific token stored in secure hardware. Merchants with card-on-file customers, such as streaming services and ride-hailing apps, increasingly store network tokens instead of card numbers. Tokens are also used for click-to-pay checkouts, in-app payments and, increasingly, for payments made by software agents on a user's behalf, where tokens can be limited to a merchant, amount or time period.

Tokenization protects stored and transmitted card data, but it does not stop every type of fraud. A criminal who takes over a customer's account at a merchant can still use the stored token to make purchases, and scams that trick cardholders into approving payments are unaffected. Network tokens require integration work by merchants and their providers, and support varies across networks, issuers and regions. Gateway tokens can create lock-in, since they work only with one provider, making it harder for merchants to switch processors. Managing the lifecycle of large numbers of tokens, covered under token lifecycle management, adds operational complexity.