Payments glossary · Security
Tokenisation
Tokenisation replaces sensitive card data, above all the card number (PAN), with a substitute value called a token that is useless outside its intended context, so systems can store and reuse payment details without holding the real number.
How Tokenisation works
In a typical setup, the merchant's gateway or PSP receives the card number, stores it in a secure vault and returns a token. The merchant keeps only the token and sends it back when charging the customer again, for example for a subscription or one-click checkout. If the merchant's database were breached, the tokens could not be used to make purchases elsewhere.
The main benefit for merchants is reduced PCI DSS scope. PCI SSC guidance explains that systems which store, process or transmit only tokens, and are properly segmented from the tokenisation system and the cardholder data environment, may fall outside the assessment. Anything that can detokenise, and tokens that can themselves be used to initiate transactions, may still be in scope.
Two kinds of token are common. PSP or gateway tokens are created by a payment provider and generally work only with that provider, which can make switching harder unless card data can be migrated. Network tokens are issued through the card schemes under the EMV Payment Tokenisation framework, are updated when the card is replaced, and can be used across acquirers. Many merchants use both: a provider token for storage and a network token in the authorisation.