Payment tokenization: Difference between revisions

'''[[Payment tokenization]]''' is a data-security process in which sensitive payment information, such as a [[Primary account number|primary account number]] (PAN), is replaced with a non-sensitive substitute known as a '''payment token'''. The token can be used in payment transactions without exposing the underlying card information to merchants or other parties that do not need access to it. :contentReference[oaicite:0]{index=0}

Payment tokenization is used to reduce the exposure of sensitive payment credentials and can help businesses reduce the amount of payment-card data stored in their own systems. The original payment information is generally maintained in a secure environment operated by a token service provider or other authorized entity. :contentReference[oaicite:1]{index=1}

The token generally has no usable value outside the payment environment or context for which it was created. :contentReference[oaicite:2]{index=2}

# When the token is used for a payment, the tokenization service maps it to the underlying payment information as required for authorization.

The merchant can therefore process or store the token without directly handling the underlying PAN in the same manner. :contentReference[oaicite:3]{index=3}

According to the [[Payment Card Industry Security Standards Council]], payment tokens are created by registered [[Token service provider|token service providers]] (TSPs) and can be presented to merchants in place of the corresponding PAN. During a payment-token transaction, the merchant and acquirer do not receive or have access to the corresponding PAN. :contentReference[oaicite:4]{index=4}

The exact scope and portability of merchant tokens depend on the provider and tokenization system. :contentReference[oaicite:5]{index=5}

They can be used to reduce exposure of the underlying PAN during payment authorization and may support improved payment authorization and lifecycle management. :contentReference[oaicite:6]{index=6}

The merchant receives the applicable token rather than directly receiving the underlying card number. :contentReference[oaicite:7]{index=7}

This allows subsequent transactions to be initiated using the token without requiring the customer to repeatedly provide the original payment credentials. :contentReference[oaicite:8]{index=8}

Tokenization can also reduce the scope and complexity of certain [[PCI DSS]] compliance obligations, although tokenization does not by itself eliminate all PCI DSS responsibilities. :contentReference[oaicite:9]{index=9}

Token vaults may incorporate access controls, encryption, hardware security mechanisms, monitoring, and other security controls. :contentReference[oaicite:10]{index=10}

The two concepts therefore use the term "tokenization" for substantially different purposes. :contentReference[oaicite:12]{index=12}

Tokens generated by one provider may not necessarily be portable to another provider, which can create additional complexity when payment-processing providers are changed. :contentReference[oaicite:13]{index=13}

Its security benefits depend on the design of the tokenization system, protection of the underlying payment credentials, token lifecycle management, and the security controls implemented by the organizations involved in payment processing. :contentReference[oaicite:14]{index=14}