Generating a token from the card number is essential to the security of payments made with mobile devices.
The level of tokenization used varies depending on the need and on how critical the token is.
Static Tokenization:
The token is generated once and stored in a database. The same token is used for every transaction on the card.
Semi-dynamic Tokenization:
The token is generated for a specific purpose and is used only for that purpose, for example for verification or for authorization.
Dynamic Tokenization:
A separate token is generated for each transaction, so the token data used is different every time.
How the levels differ
The key difference between the levels is how long, and for what purpose, a token can be used if it is compromised. Because a static token never changes, it carries the highest risk of being reused once it has been stolen. With a dynamic token, the data is different for every transaction, so anything copied from one transaction is useless for the next.
Where is each level used?
- Static tokenization: Used in cases such as card-on-file storage on e-commerce sites. The merchant stores the token instead of the real card number, so even if its systems suffer a data breach, the real card numbers are not exposed.
- Semi-dynamic tokenization: Covers cases where the token can be used only at a specific merchant, on a specific device or for a specific type of transaction. If anyone tries to use the token anywhere else, the transaction is declined.
- Dynamic tokenization: Used in mobile payments and HCE transactions. A new cryptogram is generated for every transaction.
In practice, they are used together
In real-world implementations, these levels are usually combined. In a mobile wallet, for example, the token number provisioned to the device may stay the same for a long time, but each transaction also generates a cryptogram unique to that transaction. As a result, even if someone knows the token number, they cannot complete a valid transaction without the cryptogram.