What is Network token?
A scheme-issued token that replaces the PAN end-to-end and is automatically updated when the underlying card is reissued.
A Network token is a scheme-specific, non-sensitive payment credential that replaces a customer's 16-digit Primary Account Number (PAN) throughout the transaction lifecycle.
Issued by card schemes like Visa (via Visa Token Service, or VTS) and Mastercard (via Mastercard Digital Enablement Service, or MDES), these tokens are fundamentally different from the proprietary tokens created by payment gateways.
A Network token is linked to the underlying card but has its own independent lifecycle.
This means it remains valid even if the physical card is lost, stolen, or expires, as the issuing bank automatically updates the token's mapping to the new card details in the background.
This automatic updating is a core feature that distinguishes network tokens from older forms of tokenisation.
From a technical perspective, when a merchant initiates a transaction using a Network token, they also provide a transaction-specific cryptogram. This cryptogram acts as a dynamic security code, assuring the issuer that the transaction is legitimate and originating from an authorised merchant.
This added layer of security, combined with the token's persistent link to the customer's account at the bank, allows issuers to assess risk more accurately.
As a result, transactions made with network tokens often see higher authorisation rates, sometimes by as much as 2-5 percentage points, and may qualify for lower interchange fees.
A common misunderstanding is that network tokens are the same as the tokens used in Apple Pay or Google Pay. While those wallets are major users of network tokenisation, the technology can and should be used by any merchant for card-on-file and recurring transactions.
Worked example
A customer has a recurring £50 monthly subscription with an online retailer. The retailer uses network tokenisation via Cardflo.
Initially, the customer's Visa card PAN was stored as a Network token. Six months later, the customer's bank reissues their card with a new number and expiry date after the old one was lost.
Normally, the next £50 subscription payment would fail with a Hard decline. However, because the retailer holds a Network token, the process is seamless.
The issuing bank has already updated the Visa Token Service with the new PAN linked to the existing token.
When the retailer's system submits the payment request with the Network token, VTS provides the up-to-date card information to the issuer, and the £50 transaction is approved.
The retailer avoids a decline, prevents Involuntary churn, and does not need to contact the customer for updated details.
Scheme notes
Both Visa and Mastercard are the primary drivers of network tokenisation. Visa's service is called Visa Token Service (VTS), and Mastercard's is Mastercard Digital Enablement Service (MDES).
While functionally similar, they have different integration points and reporting. American Express and Discover also offer their own network tokenisation solutions.
A key benefit is that tokens are often accompanied by additional data, like a PAR (Payment Account Reference), which helps link different tokens belonging to the same underlying card account.
Schemes incentivise merchant adoption through potential interchange benefits on certain transaction types and by demonstrating clear approval rate uplifts, particularly for card-on-file transactions. The use of a transaction-specific cryptogram is a mandatory component for both schemes, as it enhances security over static gateway tokens.
Why it matters for merchants
For merchants, adopting network tokenisation is one of the most effective strategies for improving authorisation rates and reducing Involuntary churn.
The automatic updating of card details prevents declines from expired or reissued cards, which is a major pain point for any subscription or recurring revenue business. This directly protects revenue and enhances customer lifetime value.
Furthermore, the enhanced security provided by network tokens can lead to lower interchange fees in some regions, directly reducing processing costs.
While the initial provisioning of a Network token can sometimes have a small one-time cost (a few pence), the ROI from increased approvals and reduced churn is substantial.
Cardflo's platform automatically provisions network tokens where available, ensuring merchants benefit from these advantages without complex integration work.
Frequently asked
How do network tokens impact interchange and processing fees?
Schemes may offer lower interchange rates or incentive programmes for transactions processed using network tokens because the risk of fraud is lower.
However, many acquirers and gateways charge a small per-transaction fee for the tokenisation service, which should be weighed against the potential for increased authorisation rates.
Do network tokens require the customer to perform SCA for every transaction?
Not necessarily. While the initial card enrolment usually involves Strong Customer Authentication (SCA) or 3D Secure, subsequent merchant-initiated transactions (MITs) using the Network token can often be processed without further friction, provided they are correctly flagged as recurring or subsequent payments.
How do I start using network tokens?
You typically access network tokens through your Payment Service Provider. The PSP must be integrated with the card schemes' tokenisation platforms (VTS for Visa, MDES for Mastercard).
When you submit a transaction, your PSP can request a Network token in place of the PAN. For merchants with Cardflo, our systems handle the provisioning and subsequent use of network tokens automatically for all eligible transactions.
Are network tokens more secure than gateway tokens?
Yes, network tokens are considered more secure. This is because each transaction requires a unique, single-use cryptogram, which is not a feature of most standard gateway tokens.
This dynamic element prevents replay attacks and provides issuers with greater confidence in the transaction's legitimacy. This increased security is a key reason why network-tokenised transactions see higher approval rates.
Do network tokens completely eliminate the need for an Account Updater service?
Network tokens significantly overlap with the main function of a batch-based Account Updater service, which is to refresh expired or replaced card details. For cards that are enrolled in the scheme's tokenisation service, the updates happen in near real-time, making a separate updater call unnecessary.
However, not all cards are eligible for network tokenisation, so running Account Updater can still be a valuable fallback to maximise coverage.
Can a Network token ever be declined?
Yes, a transaction using a Network token can still be declined for various reasons. These include insufficient funds, a suspected fraudulent transaction based on other risk factors, or a block placed on the account by the cardholder.
However, declines due to invalid card details (expiry, wrong number) are effectively eliminated, which accounts for a significant portion of all declines for recurring payments.
Is there a cost associated with using network tokens?
Card schemes or PSPs may sometimes charge a small fee for provisioning a Network token, and potentially a per-transaction fee for its use. These fees are typically very low, often a few pence per token.
The cost is generally far outweighed by the financial benefits, which include higher approval rates, reduced customer churn, and potentially lower interchange fees on the processed transactions.
See how Network token plays out in practice
Industries and regions where this term drives real acquiring, routing, or dispute decisions.
Related terms
A PCI DSS compliant store of tokenised card credentials that lets a merchant charge a card again without holding the PAN.
Replacing sensitive card data with a non-sensitive surrogate value that can be stored and reused without PCI scope.
A scheme service that automatically updates stored card numbers and expiry dates when an issuer reissues a card.
An authorisation response refusing to fund a transaction, returned by the issuer with a reason code.
Related guides.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.