Understanding Payment Tokenization

It’s a buzzword in the payments industry, but how does it work?

Credit card tokenization is a security measure that protects cardholder data as it passes through channels of the payment processing system . It converts card data, such as an individual’s Primary Account Number (PAN), into randomly generated codes called tokens. Each token serves as a substitute to live data in a company’s payment database and requires a specific tokenization system to be reverted. “Keys,” or identifiers of the tokens, are mapped out in a tokenization system, which is located at the data’s destination: the payment processor.

Tokenization vs. Encryption

The goal of credit card tokenization is to render cardholder data meaningless until it’s processed. In the case of a security breach, a token is a non-sensitive string of characters rather than the valuable payment data it represents. It differs from encryption in that encryption is reversible using a mathematical algorithm. There’s a specific formula linking live data to its encrypted form, whereas tokenized data is random and requires a unique identifying system to be “unlocked.”

Conserving Resources

Merchants benefit from credit card tokenization because it frees them from the risks of storing and transmitting cardholder data. When a consumer makes a card payment, the card data only enters the merchant’s network in the form of a token, so there’s less liability for the merchant in the case of a security breach. With less raw data to protect, the business can shrink its Payment Card Industry Data Security Standard (PCI DSS) scope.

Tokenization is a convenient tool for subscription billing . Rather than collect cardholder data to process recurring payments, a business can keep an individual’s card information on file in the form of a token so that it can be used again. The token can only be reverted to live data when it gets transmitted to the highly-secure payment processor. One-click checkouts and mobile wallet applications such as Apple Pay also utilize tokenization. Customers can rely on the secure tokens stored on their accounts rather than re-enter sensitive card information every time they make a payment.