Push provisioning is a method of adding a payment card to a digital wallet, a wearable or a merchant's stored-card file in which the card issuer starts the process and supplies the card details itself. The cardholder taps a button such as Add to wallet inside the issuer's banking app, and the issuer passes an encrypted package of card data to the wallet. The cardholder never types the card number, expiry date or security code.
It is one of the main forms of card provisioning and is the usual technique behind in-app provisioning. The alternative is manual provisioning, where the cardholder opens the wallet, keys in or photographs the card, and is then checked by the issuer. Push provisioning is used by banks, fintech card programs and prepaid issuers, and it depends on the tokenization services run by the card networks.
How the flow works
The exact steps differ by wallet and network, but the pattern is consistent.
- The cardholder signs in to the issuer's app, which has already authenticated them with a password, biometric check or device binding.
- The cardholder chooses a card and a destination wallet. The app asks the issuer's servers, or its issuer processor, for a provisioning payload.
- The issuer builds the payload, which contains the card details and cardholder data, encrypts it with keys agreed with the network or wallet, and returns it to the app.
- The app hands the payload to the wallet through the wallet's software kit. The wallet, acting as a token requestor, forwards it to the network's token service provider.
- The token service asks the issuer to approve the request, creates a payment token tied to that device or merchant, and delivers it to the wallet, where it is stored in a secure element or in protected software.
From then on the wallet pays with the token rather than the real card number. The whole exchange normally takes a few seconds.
Why issuers use it
The main benefit is that the issuer has already identified the cardholder. In manual provisioning the issuer receives a request from an unknown device and must decide whether to approve it, decline it or ask for extra proof, commonly a one-time password or a call to the service center. With push provisioning the request arrives from an authenticated session, so issuers generally approve it without a further challenge. Fewer cardholders abandon the process, and more cards end up active in wallets.
It also allows a card to be used before the plastic arrives. A newly issued account can be pushed to a phone on the day it is opened, which pairs naturally with virtual cards and instant issuance. For the issuer this brings forward the first transaction and reduces the number of accounts that are opened but never used.
Destinations beyond phone wallets
The same technique is used to place a card with merchants and other token requestors. An issuer app can offer to add a card to a retailer, a streaming service or a ride-hailing account, creating a merchant-specific card network token that the merchant keeps on file in place of the card number. Because the token is managed by the network, it survives card reissue after expiry or loss, so recurring charges continue without the customer updating details.
Wearables and connected devices are provisioned in a similar way, often through a companion phone app. Each destination receives its own token, so a single card may have many tokens in circulation, each of which can be suspended or deleted independently.
Roles and requirements
An issuer that wants to offer push provisioning has to complete several pieces of work. It must enroll its card ranges in the networks' network tokenization services, either directly or through its processor. It must sign agreements with each wallet provider and meet that provider's technical and design rules, which are tested before launch. Its app must integrate the wallet's software kit, and its back end must be able to produce encrypted payloads and respond to token approval and status messages.
Program managers and fintech companies that issue through a sponsor bank usually rely on the processor's provisioning interface rather than building their own. After launch the issuer is responsible for token lifecycle management: suspending tokens when a card is frozen, deleting them when an account closes and updating them when card details change.
Risks and controls
Push provisioning moves the point of risk from the wallet to the issuer's own app. If a criminal gains control of a customer's banking login, through phishing or malware, they can push the victim's card into a wallet on their own device without needing the physical card or a text-message code. Wallet provisioning fraud of this kind is a recognized result of account takeover.
Issuers therefore treat the provisioning request as a sensitive action. Common controls include requiring fresh multi-factor authentication immediately before the push, checking whether the device is new to the customer, limiting the number of tokens per card, delaying or reviewing provisioning shortly after a change of phone number or password, and notifying the cardholder each time a card is added to a wallet. Networks also score each token request and pass the result to the issuer to help it decide.