What Is Card Tokenisation and What Are Network Tokens?
Card tokenisation replaces a real card number (the PAN) with a substitute value called a token. The token can be stored and used to process payments, but it is useless to a criminal who steals it, because it cannot be used outside the system that issued it. Tokenisation is the reason a merchant can offer "save my card" without ever storing an actual card number.
There are two main kinds of token in everyday use: gateway (or provider) tokens, created by the payment provider, and network tokens, created by the card schemes themselves. They solve the same core security problem in different ways and are often used together.
Why Tokenise Card Numbers at All?
A stored card number is a liability. If a database of real PANs leaks, every card in it can be abused anywhere. Storing raw card data also pulls the merchant deep into PCI DSS compliance obligations. Tokenisation addresses both problems:
- A stolen token cannot be used to make payments elsewhere, so a breach of tokens is far less damaging than a breach of card numbers.
- Because the merchant stores only tokens, most of the PCI DSS burden shifts to the payment provider. See PCI DSS Explained.
Tokenisation is different from encryption (which is reversible with the right key) and hashing (which is one-way but not usable for payments). The distinctions are covered in Tokenisation, Encryption and Hashing.
What Is a Gateway Token?
When a customer saves a card at checkout, the payment provider stores the real card details in its secure, PCI-compliant vault and gives the merchant a token in return. The merchant uses that token for future charges, refunds and subscription billing.
Characteristics of gateway tokens:
- They only work with the provider that issued them.
- The underlying card details are static; if the card expires or is replaced, the token can start failing unless the details are updated.
- They are simple and universal, working for any Visa or Mastercard card.
What Is a Network Token?
A network token is issued by the card scheme itself (Visa Token Service or Mastercard's tokenisation platform) with the participation of the issuing bank. Instead of merely referencing the stored PAN, the scheme issues a distinct token PAN that stands in for the real card within the network.
Network tokens have properties that gateway tokens cannot match:
- Automatic updates – when the bank reissues or replaces the card, the network token stays valid and keeps working. This is a major benefit for subscription businesses fighting expired-card failures.
- Merchant scoping – a network token is bound to a specific merchant, so it cannot be replayed elsewhere if stolen.
- Cryptograms – network token transactions can carry a dynamic cryptogram, similar to an EMV chip transaction, giving issuers stronger assurance.
- Better approval rates – because issuers trust tokenised transactions more, network-tokenised payments tend to be approved more often than raw PAN transactions.
Digital wallets such as Apple Pay and Google Pay are built entirely on this technology: the card in the wallet is a device-bound network token. See What Are Digital Wallets?.
Gateway Tokens vs Network Tokens
| Aspect | Gateway token | Network token |
|---|---|---|
| Issued by | Payment provider | Card scheme (with the issuer) |
| Works with | The issuing provider only | The card network, for the enrolled merchant |
| Card reissue or expiry | Token may start failing | Token updated automatically |
| Security extras | Vault storage | Merchant scoping, dynamic cryptograms |
| Typical use | Saved cards, subscriptions | Wallets, subscriptions, card-on-file at scale |
In practice a merchant does not choose between them. The merchant integrates with a provider using gateway tokens, and the provider provisions network tokens underneath where supported, combining the simplicity of the first with the resilience of the second.
Why Does Tokenisation Matter for Recurring Billing?
Stored-card billing lives or dies by whether the saved credentials still work months or years later. Network tokens and account updater services dramatically reduce failures caused by expired and reissued cards. See Recurring Card Payments: CIT and MIT and Backup Cards and Account Updaters.
Related Topics
3D Secure
Learn how 3D Secure (Verified by Visa, Mastercard Identity Check) authenticates online card payments, shifts fraud liability and reduces chargebacks.
Debit Orders
How debit orders work in South Africa, including EFT debit orders, mandates, action dates, CDV account validation, unpaids, disputes and NAEDO migration.