Tokenization
Replacing a card number with a unique substitute value, a token, that can be stored and used for payments without exposing the real number.
In short
- If a token is stolen, it is useless outside the context it was created for.
- Network tokens from Visa and Mastercard update automatically when a card is reissued.
- Storing tokens instead of card numbers takes most systems out of PCI DSS scope.
Tokenization swaps sensitive payment data, usually the card number, for a token: a random value with no mathematical link to the original. The real card number is stored securely by a token service, and the merchant keeps only the token, which it uses for future charges.
Types of tokens
- Payment provider tokens: created by a merchant's gateway or PSP, usable only with that provider.
- Network tokens: issued by the card networks, such as Visa and Mastercard, and tied to a specific merchant. They are updated automatically when a card expires or is replaced, which keeps subscriptions and stored cards working.
- Device tokens: used by mobile wallets like Apple Pay and Google Pay, where the phone holds a token instead of the card number.
Why it matters
Tokens reduce the damage of a data breach, because stolen tokens can't be used at other merchants. They reduce PCI DSS scope, because systems that hold only tokens don't store card data. Network tokens also tend to improve approval rates, since issuers can trust them more than raw card numbers, and they cut failed payments from expired cards.
Tokenization and encryption
Encryption scrambles data so it can be unscrambled with a key. Tokenization replaces the data entirely. Payment systems usually use both: encryption to protect card data in transit, tokenization to avoid storing it at all.
Worked example
A card replaced without a failed payment
A customer pays for an annual software plan with a card stored as a network token. Mid-year, the bank reissues the card with a new number after a fraud alert. The network updates the token automatically, and the renewal charge goes through on the new card without the customer doing anything or the merchant ever seeing either card number.