Network Token

A network token is the substitute value a card scheme issues to stand in for a real card number. It looks like a card number and it moves through the same message fields, but it is not the account number itself. EMVCo, which sets the specification behind it, describes payment tokenisation as replacing valuable card data with payment tokens to make mobile and online payments safer. The token is a unique alternative value that stands in for the primary account number. This entry is about the token itself. The process that creates one is a separate subject.

What makes a network token more than a swapped number is that its use is fenced in. EMVCo puts it plainly: a payment token is constrained in how it can be used, for example to one merchant, one device or one payment scenario. A stolen card number works anywhere. A stolen token that is tied to one shop and one phone does not, because the checks around it will turn it down elsewhere. That fence is the whole point. It is why a token is worth less to a thief than the number it replaced, and why a leak of tokens is a smaller event than a leak of card numbers.

What A Token Is Tied To

EMVCo names three kinds of fence. The presentment mode, which is how the token may be shown at the point of sale. The device, where a token is issued for one phone or watch. And the merchant, where a token works only at one shop. A token may also be issued for a single guest checkout and no more. So two tokens sitting on the same card can behave in quite different ways. One may work only in a shop's own app. The other may work only when tapped from one watch, and nowhere else at all.

The Reference That Links It Back

A token hides the card number, which creates a problem. If the number is gone, how does anyone tie a wallet payment and a card payment to the same account? The answer is the Payment Account Reference, or PAR. EMVCo describes it as a way to link payments that use tokens with the card number those tokens were issued for. It supports fraud screening, aml monitoring, loyalty schemes and cases such as transit.

How PAR Is Built

A primer on the Payment Account Reference sets out the detail. PAR is a fixed 29-character upper-case value, and the first 4 characters name the body that governs it. It has a one-to-one tie to the card number and a one-to-many tie to the tokens. Crucially, PAR cannot be used to start a payment, and it must be built so it cannot be worked back into a card number. It is a label, not a key. That distinction is what lets a shop join up a customer's payments without holding anything a thief could spend.

What A Merchant Actually Holds

A shop taking wallet payments generally holds the token, not the primary account number. That is a real cut in exposure, because a leaked fenced token is less use than a leaked card number. It does not empty the compliance question, though, and how much scope shifts depends on the setup rather than on the token alone.

What It Changes For Approvals

Issuers tend to view a token-backed payment more kindly than a raw card number typed into a form, because more is known about how it was set up. That is a tendency, not a rule, and the issuer keeps the final call. finera.'s guide to improving payment approval rates across markets covers the other levers that move the same number, most of which matter more than the token on its own.

Where Tokens Turn Up Most

Wallets on phones are the case most people see. When a card is added to a wallet, what lands on the device is a token, not the card. finera.'s merchant guide to Google Pay walks through what that looks like from the shop's side. Stored cards for repeat billing are the other big case, and there a token that survives a card being reissued saves a failed payment later.

Tokens Against Gateway Tokens

This is a common mix-up worth clearing. A gateway or provider may issue a token of its own to stand in for a card inside its own vault. That is useful, but it is local: it means nothing to any other provider. A network token is issued by the scheme, so it travels with the payment and is understood across the network. A shop moving provider will find one portable and the other not.

What To Ask Before Relying On Them

Three questions cover most of it. Does the provider pass the network token through, or swap it for one of its own? How do refunds and disputes behave when the first payment used a token? And is PAR available, since without it a shop loses the thread between a wallet payment and a card payment from the same person? finera.'s overview of the benefits of tokenisation for businesses covers the wider case. The answers tend to differ more by provider than they do by card scheme.