Token

A token is a stand-in value that takes the place of real payment data. Instead of holding a customer's 16-digit card number, a merchant holds a string that often looks like a card number, works like one for the jobs it was issued for, and means very little to anyone who steals it. The real number sits with a token service firm under proper controls. The token is what moves between systems, what gets stored, and what ends up in the merchant's own records. Everything the shop does, it does with the stand-in.

The value here is in what it takes away, not in what it adds. A store of tokens is a duller target than a store of card numbers, since a stolen token generally cannot be carried off and spent, provided it is restricted to one merchant, device or channel. Tokens can also be fenced in by design: tied to one merchant, one device, one channel, or to a single use. The shared framework the card schemes work to is set out in the EMV payment tokenisation standard, and card scheme rules such as the Visa Core Rules govern how tokens may be asked for and used.

The Shape Of One

Most payment tokens keep the format of the thing they stand in for, so a 16-digit card number becomes a 16-digit token. That sounds like a small detail and it is the reason take-up was possible at all: systems built to hold a card number can hold a token without being rewritten. The token tends to keep the last 4 digits and the card brand so receipts and support screens still read well. The middle of it means nothing.

Token Next To Tokenisation

The two words get used as if they were one, and keeping them apart helps. Tokenisation is the process: the service, the vault, the swapping of real data for stand-in data and back. A token is the thing that process hands you. A firm takes up the process; its systems then hold the tokens. The split matters when scoping a project, because questions about the process are about who runs the vault, while questions about the token are about where it may be used.

The Kinds You Will Meet

Tokens do not all act alike. A gateway token comes from a payment firm and works only with that firm. A network token comes from the card scheme, works across firms, and updates itself when the card behind it is replaced. A single-use token is good for one payment and then dead. Each kind trades reach against control, so a business tends to end up holding more than one sort of token.

The Real Number Sits Elsewhere

The real primary account number goes into a vault run by the token service firm, which may be the card scheme, the acquirer or a specialist. Turning a token back into a card number is a guarded call, logged and tightly capped, and most merchant systems should have no route to it at all. If a shop can do it on demand, the token has not taken the risk away. It has moved it one step.

Scope Of Use Is The Control

What a token is worth to an attacker rests on where it is allowed to work. Scheme tokens carry domain controls: a token issued for one merchant, or for one wallet on one phone, is turned away elsewhere. A token with no domain limits is closer to a card number with extra steps, so the scope settings are worth reading and not worth taking as shipped.

Tokens And Repeat Billing

This is where tokens repay the work. A subscription running on a stored token lives through a card being replaced after loss or expiry, which a stored card number does not. Keeping a subscription payment alive through a card change takes out a chunk of churn nobody chose. The flags that mark a charge as part of an agreed series still apply, including those for an unscheduled charge on a stored credential.

Moving Them Is The Catch

A gateway token belongs to the gateway that made it. Moving to a new firm means shifting the stored credentials across, a tight process that both sides have to agree to and that takes weeks. Scheme tokens travel better, since the scheme and not the firm holds the mapping. Anyone picking a route should ask what happens on exit before signing, because the answer shapes how hard it is to change supplier later.

Living With Tokens

Treat the token as the default record and keep card numbers out of your systems wherever you can. Store the brand and last 4 digits beside it, so support staff can talk to a customer without unwrapping anything. Keep the right to unwrap with as few systems as you can, and log every use of it. Ask which kind of token you are being handed, and what its domain limits are. Check the exit terms before you lean on a firm's own format. Pair tokens with encryption in transit, since the two cover different gaps. Review who holds that right once a year, because access tends to spread quietly. This piece on tokenisation versus encryption sets out the split, and the payment gateway product is designed to handle the storage side.

‍