Payment tokenisation replaces a customer’s card number with a token: a substitute value that is useless to anyone who steals it. Your systems store and use the token, while the real card number stays in a secure vault at your payment provider or with the card schemes.
For merchants, tokenisation does two things: it lowers the damage a data breach can do, and it reduces how much of your business falls under PCI DSS. This guide explains how payment tokenisation works, the difference between gateway tokens and network tokens, and what it means for high-risk merchants.
Key takeaways
- A payment token stands in for the card number (PAN). If it is stolen, it can’t be used like a real card number.
- Gateway or processor tokens are issued by your payment provider and only work with that provider.
- Network tokens are issued by the card schemes, such as the Visa Token Service and Mastercard’s tokenisation service, and stay linked to the card even when the plastic is replaced.
- Tokenisation reduces your PCI DSS scope, because card numbers no longer pass through or sit on your systems. It doesn’t remove PCI DSS completely.
- For subscriptions and stored cards, tokenisation is how you charge returning customers without storing their card details.
What is payment tokenisation?
Tokenisation is a security method that replaces sensitive data, such as a card number, with a unique substitute value called a token. The link between the token and the real card number is kept in a secure token vault, run by your payment provider or a card scheme.
Unlike encryption, where the original data can be recovered with a key, a token has no mathematical link to the card number. Without access to the vault, it reveals nothing. That is why a stolen token is far less valuable to criminals than a stolen card number.
How payment tokenisation works
- The customer enters card details at checkout, ideally in a payment form hosted by your provider.
- The provider stores the card number in its secure vault and creates a token for it.
- Your systems receive the token, not the card number, and store it with the customer’s account.
- When you charge the customer, you send the token to your provider.
- The provider or card scheme swaps the token for the real card details and sends the authorisation to the issuer.
- The result comes back to you without the card number ever touching your systems.
Gateway tokens vs network tokens
| Gateway or processor tokens | Network tokens | |
|---|---|---|
| Who issues them | Your payment gateway or processor | The card schemes, for example Visa Token Service and Mastercard’s tokenisation service |
| Where they work | Only with the provider that issued them | Across the card network, linked to the merchant |
| When the card is replaced | The token stops working if the card number changes, unless the provider uses an account updater | The token can stay valid, because the issuer updates the card behind it |
| Main benefit | Keeps card data off your systems and reduces PCI DSS scope | The same, plus fewer declines on stored cards and extra security data for the issuer |
Network tokens are built on the EMVCo payment tokenisation framework, which the card schemes use. The same technology lets mobile wallets such as Apple Pay and Google Pay keep the real card number off the phone. Many providers now combine both types: they give you their own token, and use a network token behind it where the card scheme supports it.
Tokenisation and PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) applies to every business that stores, processes or transmits card data. The more card data touches your systems, the more of your environment is in scope, and the more work compliance takes.
Tokenisation helps because card numbers no longer sit in your database. If you also use a hosted payment page or hosted card fields, the card number never passes through your servers at all, which usually puts you in one of the simplest self-assessment categories. You still have to complete your annual PCI DSS assessment, and your acquirer decides which form applies.
Why tokenisation matters for subscriptions and stored cards
If you charge customers again, for recurring billing, one-click repeat purchases or top-ups, you need to keep something that lets you charge the card later. Storing card numbers yourself is risky and expensive to secure. Storing a token is the standard way to do it.
Network tokens add another advantage: when a customer’s card expires or is replaced, the issuer can update the details behind the token, so fewer renewals fail. That matters for subscription businesses, where failed renewals turn directly into lost revenue.
Tokenisation for high-risk merchants
- Less to lose in a breach: high-risk businesses are frequent targets of fraud and attacks, and tokens are worth little to criminals.
- Easier compliance: a smaller PCI DSS scope means less work and fewer points of failure.
- Better subscription performance: fewer failed renewals with network tokens and account updater services.
- Easier moves between providers: ask in advance whether your provider can migrate stored cards to a new provider if you switch, because gateway tokens can’t be used elsewhere.
Tokenisation protects stored card data, but it doesn’t stop a criminal using a stolen card at your checkout. Combine it with 3D Secure and fraud screening.
What to ask your payment provider
- Do you tokenise card data, and where are the cards stored?
- Do you support network tokens for Visa and Mastercard?
- Do you offer an account updater for stored cards?
- Can stored cards be migrated to another provider if we switch?
- Which integration keeps card data furthest from our systems: a hosted payment page, hosted fields or an API? See our guide to payment APIs.
Frequently asked questions
What is payment tokenisation?
Payment tokenisation replaces a card number with a token, a substitute value that can be stored and used for payments but is useless if stolen. The real card number is kept in a secure vault by the payment provider or card scheme.
How does tokenisation work in a payment gateway?
The gateway receives the card details, stores them securely and returns a token to the merchant. When the merchant charges the customer, it sends the token, and the gateway swaps it for the real card details before sending the payment for authorisation.
What is the difference between tokenisation and encryption?
Encrypted data can be turned back into the original with the right key. A token has no mathematical link to the card number, so it reveals nothing without access to the token vault.
What are network tokens?
Network tokens are tokens issued by the card schemes, such as Visa and Mastercard. They stay valid when a card is replaced, because the issuer updates the card behind them, which helps reduce declines on stored cards.
Does tokenisation make my business PCI compliant?
It reduces your PCI DSS scope, because card numbers don’t sit on your systems, but it doesn’t remove PCI DSS. You still need to complete your annual assessment, usually a simpler one.
Do I need tokenisation for subscriptions?
Yes, in practice. To charge customers again without storing their card numbers, you store a token from your provider. Network tokens and account updater services also reduce failed renewals.
What is an example of payment tokenisation?
A subscription site stores a token instead of a customer’s card number. Each month it sends the token to its payment provider, which swaps it for the real card details and charges the card.
Next step
Fasto works with adult, subscription, nutraceutical, gaming, dating and hospitality merchants. Approval typically takes two to three weeks.
Get a free quote, or read about our high-risk payment gateway.
