Token types vary depending on the verification method used in a transaction. In offline transactions, general checks for token verification are performed by the mobile app and card reader, without any verification in the card system. In online transactions, token verification is sent to the issuer system and is verified by the issuer.
We can compare token verification in offline and online transactions as follows:
| Token Verification in Online Transactions | Token Verification in Offline Transactions |
| More secure | Less secure |
| Lower fraud risk | Higher fraud risk |
| Simpler to manage | Harder to manage |
| Longer transaction time | Shorter transaction time |
How does online token verification work?
In online verification, the token and the cryptogram generated for the transaction are sent at the time of the transaction to the card-issuing bank or to the token service provider authorized by that bank. The token is converted into the real card number, the cryptogram is verified, and the transaction is approved only after these checks. Because every transaction is checked centrally, the security level is high. On the other hand, this requires communication, which lengthens the transaction time.
How does offline token verification work?
In offline verification, the bank is not contacted at the time of the transaction. The checks are performed by the app on the mobile device and the card reader, according to predefined rules. The transaction is transmitted to the bank afterward. Because this method is fast, it is preferred particularly in areas where transaction time is critical, such as public transportation.
How is risk limited in offline transactions?
Since the bank cannot see the transaction at the moment it happens in offline verification, risk is limited through several methods:
- The number of transactions and the total amount that can be made offline with a single token are limited.
- The single-use keys on the mobile device run out after a certain number of transactions. The device must connect to the internet for them to be renewed.
- An online transaction is required at certain intervals so the account status can be checked.
Thanks to these limits, even if an offline token is misused, the resulting damage is kept to a certain level.
