Tokenization:
Tokenization refers to generating data at a certain security level, using specific algorithms based on the credit card number, for use during the authorization stage.
In CNP (Card Not Present) transactions, it eliminates the risk of storing the original card number and of the original card number being compromised.
The tokenization process is triggered by the mobile application, generated by the issuer (the card-issuing bank), and the generated tokens are transmitted to and stored in the mobile application. The mobile application user is not aware of the generated token information, as it is produced purely for security purposes.
Detokenization:
Detokenization is the process of sending the tokenized card number submitted during the authorization stage to the card-issuing bank, with the card-issuing bank obtaining the original card number from the tokenized card number. During detokenization, checks such as token validity period and token encryption are performed.
Tokenization in the transaction flow
The flow of a transaction made with a tokenized card is generally as follows:
- The cardholder makes a payment with the card on their phone, and the token number is sent to the POS.
- The merchant's bank forwards the transaction to the card scheme, like any other transaction.
- The card scheme or token service provider converts the token number into the real card number.
- The transaction is forwarded to the card-issuing bank with the real card number and approved.
- The response message returns to the merchant with the token number again.
In this flow, the merchant and the merchant's bank never see the real card number.
Who is the token service provider?
The token service provider (TSP) is the organization responsible for generating, storing, and converting tokens into the real card number. This role can be undertaken by card schemes, card-issuing banks, or authorized third-party organizations.
Benefits for the merchant
When a merchant stores tokens instead of storing real card numbers in its systems, it significantly reduces the risk of data breaches. It also eases some of the security requirements that must be met under PCI DSS.
