Card tokenisation

What it means

Card tokenisation replaces a payment card number with a unique code, a token, used for mobile and online payments. Outside its specific context the token has no value, so even if it leaks, an attacker cannot pay with the real card.

Tokenisation is used by mobile wallets on phones and watches and by payment gateways when storing cards for repeat purchases. Only the card issuer and the card scheme know the real card number, translating the token back into the card at payment time.

For the merchant the main benefit is never storing the real card number. This greatly reduces the risk from a data breach and makes it easier to comply with the PCI DSS security standard, which applies to anyone who processes or stores payment card data.

How it works in practice

For an online store or a service with a subscription model, tokenisation makes it possible to store the customer's card and charge recurring payments without keeping sensitive data in the company's own database. The token is held by the payment gateway provider, which is responsible for its security.

Tokenisation complements other security measures such as 3D Secure and strong customer authentication under PSD2. For payments with a stored token, the strong authentication rules apply differently depending on whether the customer or the merchant initiates the payment.

When choosing a payment partner, that is an acquiring provider or gateway, it is worth checking whether it supports tokenisation, how it updates tokens when a card is replaced and whether tokens can be migrated to another provider if needed.

What to watch out for

Tokenisation does not remove all obligations. The company must still secure its website and systems so that an attacker cannot, for example, inject a fake payment form. The scope of PCI DSS obligations does, however, shrink considerably if cards are handled solely by a certified provider.

Stored tokens are tied to a particular provider. When switching payment gateways, migrating them can be complicated and customers may have to re-enter their cards. It is therefore worth considering exit terms when signing the contract.