A tokenized card number is a number used in place of a physical card number, allowing transactions to be carried out securely.
Characteristics:
- It is generated by the TSP (Token Service Provider).
- It is used by the cardholder or the merchant.
- It travels across the payment systems network (acquirer–switch–issuer).
- Detokenization (conversion back to the original card number) is performed by the TSP (Token Service Provider).
- It is verified by the issuer (the institution that issued the card).
- It has a defined validity period (expiration date).
How it differs from a real card number
Because a tokenized card number has the same format as a real card number, payment systems process it just like an ordinary card number. However, this number can only be converted back into the real card number by the issuing bank or the token service provider — nowhere else. As a result, even if the token is compromised, the real card number is never exposed.
Usage can be restricted
Where a token can be used can be defined at the time it is created. For example:
- Tokens that can only be used on a specific device (phone, smartwatch)
- Tokens that can only be used at a specific merchant
- Tokens that can only be used through a specific transaction channel (contactless, e-commerce)
If an attempt is made to use a token outside the scope it was defined for, the transaction is declined.
What happens when the card is renewed?
When a physical card is renewed or its expiration date changes, the token usually stays the same. The token service provider updates the mapping between the token and the new card details. This means the cardholder does not need to re-register the card in their mobile wallet or on shopping sites where it is saved.
Token cancellation
If a phone is lost, only the token on that device can be canceled. The physical card and the tokens on other devices continue to be used.