Cards
Tokenisation
Replacing sensitive card data with a non-sensitive surrogate value that can be stored and reused without PCI scope.
Tokenisation is the process of substituting sensitive Primary Account Numbers (PANs) with a unique, non-sensitive surrogate value known as a token. This mechanism allows merchants to store a reference to the cardholder's data without coming into full scope of PCI DSS requirements for storing sensitive information. There are two primary forms: merchant-level tokens, which are usually specific to a single acquirer or gateway, and network tokens, issued by schemes such as Visa and Mastercard through the Token Service Provider (TSP). Network tokens are generally considered more robust as they remain valid even if the underlying card is reissued due to expiry or loss, a process often facilitated by the Account Updater service. By using network tokens, merchants may see improved authorisation rates and potentially lower interchange costs, as these tokens are typically accompanied by a cryptogram that validates the transaction's integrity through the 3DS or SCA framework.
Frequently asked
How does tokenisation differ from encryption in a payment environment?
Encryption uses an algorithm to hide data that can be decrypted with a key, whereas tokenisation replaces the data entirely with a non-mathematical placeholder. This means that if a database of tokens is breached, the values are useless to an attacker as they cannot be reversed to reveal the original PAN without access to the secure token vault.
What is the primary advantage of using network tokens over gateway-specific tokens?
Network tokens offer greater portability and longevity because they are recognised across the entire payment ecosystem rather than being tied to a single payment service provider. They automatically update when a bank issues a new card, reducing the likelihood of transaction declines due to outdated card details and ensuring the merchant can maintain a seamless recurring billing cycle.
Related terms
A PCI-DSS-compliant store of tokenised card credentials that lets a merchant charge a card again without holding the PAN.
A scheme-issued token that replaces the PAN end-to-end and is automatically updated when the underlying card is reissued.
The Payment Card Industry Data Security Standard, the scheme-mandated framework for handling cardholder data.
Ready for velocity?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.