Payment tokenization

Payment tokenization is a data-security process in which sensitive payment information, such as a primary account number (PAN), is replaced with a non-sensitive substitute known as a payment token. The token can be used in payment transactions without exposing the underlying card information to merchants or other parties that do not need access to it.

Payment tokenization is used to reduce the exposure of sensitive payment credentials and can help businesses reduce the amount of payment-card data stored in their own systems. The original payment information is generally maintained in a secure environment operated by a token service provider or other authorized entity.

Concept

A simplified tokenization process can be represented as:

$Payment Credentials \to Tokenization Service \to Payment Token$

The payment token can then be used in place of the original payment credentials:

$Payment Token \to Payment Processing \to Authorization$

The token generally has no usable value outside the payment environment or context for which it was created.

How payment tokenization works

A typical payment-tokenization process consists of several stages:

The customer provides payment credentials during a transaction.
The payment credentials are transmitted to a tokenization service.
The tokenization service generates a token associated with the underlying payment credentials.
The sensitive payment information is maintained in a secure token vault.
The merchant or other participating system stores or uses the token rather than the original payment credentials.
When the token is used for a payment, the tokenization service maps it to the underlying payment information as required for authorization.

A simplified representation is:

$PAN \to Tokenization \to Token \to Payment Authorization$

The merchant can therefore process or store the token without directly handling the underlying PAN in the same manner.

Payment tokens

A payment token is a surrogate value that replaces a payment card's PAN during a transaction.

According to the Payment Card Industry Security Standards Council, payment tokens are created by registered token service providers (TSPs) and can be presented to merchants in place of the corresponding PAN. During a payment-token transaction, the merchant and acquirer do not receive or have access to the corresponding PAN.

Types of payment tokenization

Payment tokenization can be implemented in different forms depending on where the token is generated and how it is used.

Common forms include:

merchant or gateway tokenization;
network tokenization;
digital-wallet tokenization.

Merchant tokenization

Merchant tokenization or gateway tokenization replaces sensitive payment credentials with a token generated by a payment gateway, processor, or other tokenization provider.

The merchant generally stores the token while the original payment information is maintained by the provider's secure system.

This approach can be particularly useful for:

saved payment methods;
recurring payments;
subscriptions;
refunds;
one-click payments.

The exact scope and portability of merchant tokens depend on the provider and tokenization system.

Network tokenization

Network tokenization uses payment-network infrastructure to replace the PAN with a network payment token.

Network tokens can be associated with a particular merchant, device, payment environment, or other transaction context.

They can be used to reduce exposure of the underlying PAN during payment authorization and may support improved payment authorization and lifecycle management.

Digital wallet tokenization

Digital wallets such as Apple Pay, Google Pay, and Samsung Pay use payment-tokenization mechanisms to protect payment credentials.

A simplified relationship is:

$Card Credentials \to Payment Token \to Digital Wallet \to Merchant$

The merchant receives the applicable token rather than directly receiving the underlying card number.

Recurring payments

Payment tokenization can be used for recurring transactions such as subscriptions.

Instead of storing the customer's original card information, a merchant can store a token associated with the payment credentials.

A simplified process is:

$Initial Payment \to Token Creation \to Token Storage \to Recurring Payment$

This allows subsequent transactions to be initiated using the token without requiring the customer to repeatedly provide the original payment credentials.

Security benefits

Payment tokenization reduces the exposure of sensitive payment information by replacing it with a surrogate value.

Potential benefits include:

reduced exposure of PANs;
reduced consequences of certain data breaches;
improved protection of stored payment credentials;
reduced handling of sensitive payment data;
support for payment-card security requirements;
safer recurring and stored-card transactions.

Tokenization can also reduce the scope and complexity of certain PCI DSS compliance obligations, although tokenization does not by itself eliminate all PCI DSS responsibilities.

Token vault

A token vault is a secure system that maintains the relationship between payment tokens and the underlying sensitive payment information.

A simplified representation is:

$Token \leftrightarrow Secure Token Vault \leftrightarrow PAN$

The merchant generally does not need direct access to the PAN when using the token for supported payment operations.

Token vaults may incorporate access controls, encryption, hardware security mechanisms, monitoring, and other security controls.

Tokenization and encryption

Tokenization and encryption are different security techniques.

Encryption transforms data using a cryptographic process so that it can be converted back into its original form using the appropriate key.

Tokenization replaces sensitive information with a substitute value that is mapped to the original information through a tokenization system.

A simplified distinction is:

$Encryption \to Cryptographically Transformed Data$

$Tokenization \to Substitute Token$

Tokenization and encryption can be used together to protect payment information throughout its lifecycle.

Tokenization and blockchain

Payment tokenization should not be confused with blockchain-based asset tokenization.

Payment tokenization generally replaces sensitive payment credentials with a surrogate value for security purposes.

Blockchain-based tokenization generally creates digital representations of assets, rights, or value on a blockchain or distributed ledger.

A simplified distinction is:

$Payment Tokenization \to Protection of Payment Credentials$

$Blockchain Tokenization \to Digital Representation of Assets or Rights$

The two concepts therefore use the term "tokenization" for substantially different purposes.

Limitations and challenges

Payment-tokenization systems can involve several challenges, including:

integration with existing payment infrastructure;
management of tokens across multiple providers;
token portability;
migration of legacy payment credentials;
interoperability;
fraud detection;
maintaining appropriate security controls;
managing token lifecycle and expiration.

Tokens generated by one provider may not necessarily be portable to another provider, which can create additional complexity when payment-processing providers are changed.

Importance

Payment tokenization is an important security mechanism in modern payment systems. By replacing sensitive payment credentials with tokens, it can reduce the exposure of payment-card information while supporting online payments, mobile wallets, stored payment methods, recurring billing, and other digital-payment applications.

Its security benefits depend on the design of the tokenization system, protection of the underlying payment credentials, token lifecycle management, and the security controls implemented by the organizations involved in payment processing.