Understanding Tokenization
Overview
Tokenization is a security technology that protects sensitive data by replacing it with non-sensitive placeholders called "tokens". This approach allows businesses to handle sensitive information securely while maintaining functionality.
How Tokenization Works
When a customer enters their payment credentials during checkout, instead of storing that sensitive data, your systems:
- Send the payment data to a tokenization provider
- Receive back a token that represents those credentials
- Store this token within the customer's account for future transactions
The token may maintain the format of the original data but has no mathematical relationship to it. This means tokens cannot be reversed back to the original card numbers.
Benefits of Tokenization
Improved Security
- Removes sensitive data from your systems
- Reduces impact of potential breaches
- Cannot be reversed to original data
- Faster checkout with minimal friction
Better Customer Experience
- Streamlines recurring payments
- Faster checkout process
- Supports subscription models
Simplified Compliance
- Reduces/removes PCI DSS scope
- Minimizes compliance costs
- Simplifies security audits
Tokenization vs Encryption
Unlike encryption which uses mathematical algorithms that can be reversed with the right key(s), tokenization completely removes sensitive data from your systems. The tokens have no mathematical relationship to the original data and can only be exchanged for the real data by the tokenization provider.
While encrypted data remains vulnerable if encryption keys are compromised, tokenized data provides no value to attackers even in the event of a breach.
Network Tokens
What are network tokens?
- Card networks (Visa, Mastercard, Amex, and Discover) offer their own tokens, which can be utilized in processing transactions instead of a PAN.
- Network tokens are maintained by the networks so they always stay current, even if the underlying card data changes.
- For example, if a customer loses their card or if the card expires, the network updates the token directly, ensuring it continues to work without the customer needing to update their payment information. This helps reduce customer friction in the checkout flow and avoids stale payment credentials in recurring charges.
Why use network tokens?
Lifecycle Management
Ensures tokens remain updated indefinitely
Enhances Security
Tokens are merchant-specific & cryptogram
Personalized experience
Using card art
Increased Authorization Rates
Approximately 3% reported by Visa
Lower interchange fees
Processor flexibility
Network Tokens vs PCI Tokens
Network Tokens | PCI Tokens |
|---|---|
Based on EMVCo Payment Tokenization Specification | Not based on an industry standard for format (e.g. can be created in different ways) |
Generated by the card schemes - Mastercard, Visa, American Express, Discover | Generated by a payment gateway, PSP, or agnostic token provider |
Can be passed through the payment ecosystem before being detokenized by the card schemes | Must be detokenized by the gateway, PSP, or agnostic token provider before being passed into the payment ecosystem |
Account Updater
What is Account Updater?
The Account Updater service, offered by the card networks, facilitates PAN lifecycle management by retrieving the new PAN information in case of an expired, lost, or stolen card. Ensuring accurate and up-to-date credentials are available at the time of purchase. Provides updated PAN (primary account number) to the token provider to ensure the credential is always accurate and up-to-date.
- Builds on top of the merchant’s payment card vault
- Account Updater can be leveraged to improve Life-Cycle Management when network tokens are not possible, due to partial issuer support, and performance on alternative rails.
Benefits of Account Updater
Real-time
Agnostic solution
Save lost revenue
Recover failed payments from invalid/expired cards
Minimize duplicative costs
By only updating cards when there is likely buying intent
Processor Flexibility
Leverage updated cards across multiple processors
Why use Account Updater if already using Network Tokens?
Network Tokenization has a few gaps in support and experience that Account Updater mitigates, including:
- Partial Issuer Support
- Underperforms on alternative rails; e.g PINless (US), Cartes Bancaires (FR), EFTPOS (AU)