Tokenisation
Also known as: Payment tokenisation, Network token
Tokenisation replaces a card number with a substitute value, the token, that is limited to a particular device, merchant or use. If the token is stolen it is of little use elsewhere. EMVCo publishes the specification, and tokens are issued by token service providers.
Last reviewed
Example
When you add a card to a phone wallet, the wallet stores a token. The merchant never sees the real card number.
Your card number is a key that opens your account. Tokenisation hands out a copy that only opens one door.
What it does
EMVCo defines payment tokenisation as replacing the card number with "a unique alternative value, the EMV Payment Token". The real number, the PAN, stays with the issuer and the token service. What travels through the merchant's systems is the substitute.
The substitute is constrained. In EMVCo's words, a token "is constrained in how it can be used". It may work only with one device, one merchant or one kind of payment. A criminal who steals it from a database cannot spend it somewhere else.
Who issues tokens
Tokens are created by token service providers. EMVCo manages and assigns the codes that identify each provider worldwide, so a token can always be traced back to who issued it.
Where you meet it
A phone wallet is the everyday case. Add a card, and the wallet holds a token. When you tap, the terminal receives the token and a one-time payment code, not your card number. A merchant who stores a customer's card for repeat billing can hold a token too.
Do not confuse it with encryption
Encryption scrambles data and can be reversed with a key. A token is a stand-in value that is only meaningful inside the system that issued it. A database full of tokens is a smaller prize than a database full of card numbers, which is why tokens matter to anyone handling card data under PCI DSS.
Tokenisation does not replace authentication. It limits what a stolen number can do. Who is paying is a separate question.