Network tokenization for card payments

A merchant that stores cards for later use, the card on file, used to hold the card number itself or a token from its payment service provider. A PSP token is only valid inside that provider's systems, and the provider still sends the real card number to the network. A network token goes the whole way: it is created by the card network under the EMVCo standard, can be restricted to one merchant, channel or device, and the network translates it back to the card number (Sikich).

Each payment with a network token comes with a cryptogram that is valid once and checked by the issuer. A Payment Account Reference links all tokens of one card to the card account, so a merchant can recognize a returning customer without holding the card number (Pagos). The hub answer on payment tokenization explains the token idea for payments in general.

Visa and Mastercard split stored-card payments into customer-initiated transactions, where the cardholder is present, and merchant-initiated ones such as a subscription renewal. The first payment is customer-initiated, carries a consent flag and, in the EEA, strong customer authentication. Each later merchant-initiated payment has to reference the first one with Visa's network transaction ID or Mastercard's trace ID, and networks charge fees or fines for wrong flags (Merchant Risk Council).

Expired and reissued cards are the usual reason a stored card fails. With card numbers, merchants rely on account updater services of the networks. A network token is updated by the network when the bank replaces the card, so the payment keeps going (Solidgate). A token in place of a stored card number also shrinks the part of the systems that falls under PCI DSS.

Mastercard developed the token standard in 2013, EMVCo adopted it, and the Mastercard Digital Enablement Service started in 2014 together with Apple Pay. More than 30 percent of Mastercard transactions worldwide are tokenized, and the company wants to end manual card entry in e-commerce in Europe by 2030, using tokens, Click to Pay and payment passkeys (Mastercard). For Just Eat Takeaway.com, tokenized payments had half the chargeback rate of manually entered cards, 5.5 percent more conversion and over 30 percent fewer declines, according to the same source.

Who requests the tokens matters when a merchant changes providers. Tokens provisioned through one provider's token requestor ID do not move with the merchant by default, a question the payment orchestration page covers under token vault portability.

Finance Loop is the meeting place for people who run stored-card payments in Germany: e-commerce and subscription merchants, payment service providers, acquirers, issuers and the card schemes. It connects the finance, IT and AI communities in Germany, Austria and Switzerland, with events in Frankfurt, Munich, Berlin and Hamburg.

Visa is an event and network partner of Finance Loop. At Capital & Code in Frankfurt, where Finance Loop is a media partner, Mastercard, PayPal and Worldline speak with AllUnity on the future of payments, payments started by AI agents among them.

Network tokenization is the replacement of a stored card number by a token that the card network issues and manages. The token is limited to one merchant, each payment carries a one-time cryptogram, and the network updates the token when the card is replaced.

A gateway or PSP token only exists in one provider's vault; the provider sends the real card number to the network. A network token is recognized by the network and the issuer, travels through the whole payment chain and stays current after a card is reissued.

Card on file, or credential on file, is a card that a merchant stores with the cardholder's consent for later payments. The networks require a consent flag on the first payment and a reference to it on every later one.

An account updater is a service of Visa and Mastercard that passes new card numbers and expiry dates from issuers to merchants that store cards. Network tokens make it unnecessary for those cards, because the network updates the token directly.