Payment tokenization

Payment tokenization is generally categorized into two types: security tokens and payment tokens. Security tokens, also known as post-authorization tokens, are used to replace sensitive information like Primary Account Numbers (PANs), such as credit card numbers either after a payment is authorized or for storing data securely (data-at-rest), such as in merchant databases. These models have been in use since the mid-2000s, following the introduction of the Payment Card Industry Data Security Standard in 2004, which established standards for safeguarding cardholder data. The Payment Card Industry Security Standards Council's 2011 Tokenization Guidelines{{Cite book |last=Tokenization Taskforce |first=Scoping SIG |url=https://listings.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.pdf |title=PCI DSS Tokenization Guidelines |date=August 2011 |publisher=Payment Card Industry Security Standards Council |year=2011}} and the proposed American National Standards Institute X9 standards emphasize using tokens primarily to secure sensitive information, not as replacements for payment credentials processed over financial networks.{{Cite book |last1=Crowe |first1=Marianne |url=https://www.bostonfed.org/-/media/Documents/PaymentStrategies/tokenization-prime-time.pdf |title=Is Payment Tokenization Ready for Primetime? Perspectives from Industry Stakeholders on the Tokenization Landscape |last2=Pandy |first2=Susan |date=11 June 2015 |publisher=Federal Reserve Bank of Atlanta and Federal Reserve Bank of Boston |pages=5}}

Traditionally, merchants stored PANs to support backend operations such as settlements, reconciliations, chargebacks, loyalty programs, and customer service.{{Cite book |last=Dubinsky |first=Ilya |url=https://books.google.com/books?id=P7OtDwAAQBAJ&dq=Payment+tokenization&pg=PA93 |title=Acquiring Card Payments |date=2019-09-03 |publisher=CRC Press |isbn=978-1-000-61757-3 |pages=89–94 |language=en}} However, with the adoption of security tokenization, merchants can substitute PANs with tokens in their systems. This not only reduces their exposure to fraud but also helps minimize the scope and cost of PCI-DSS compliance, offering a more secure and efficient way to manage cardholder data.

Payment tokenization is widely used by mobile wallets such as Apple Pay,{{Cite web |last=Geuss |first=Megan |date=2014-10-29 |title=How Apple Pay and Google Wallet actually work |url=https://arstechnica.com/gadgets/2014/10/how-mobile-payments-really-work/ |access-date=2025-07-05 |website=Ars Technica |language=en}} Google Pay,{{Cite web |last=Geuss |first=Megan |date=2015-05-28 |title=Android Pay is all about tokenization; Google Wallet takes a backseat |url=https://arstechnica.com/information-technology/2015/05/android-pay-will-embrace-tokenization-mostly-replace-google-wallet/ |access-date=2025-07-05 |website=Ars Technica |language=en}} and Samsung Pay use tokenization to safely store card data on devices. E-commerce platforms rely on it to securely retain customer payment details for recurring purchases. At the physical point of sale, EMV-enabled systems use tokenization to protect card information during in-store transactions.{{Cite journal |last1=Al-Maliki |first1=Ossama |last2=Al-Assam |first2=Hisham |date=2022-09-03 |title=A tokenization technique for improving the security of EMV contactless cards |url=https://doi.org/10.1080/19393555.2021.2001120 |journal=Information Security Journal: A Global Perspective |volume=31 |issue=5 |pages=511–526 |doi=10.1080/19393555.2021.2001120 |issn=1939-3555}} Also, subscription billing services implement tokenization to manage and safeguard payment credentials for ongoing charges.

• Tokenization (data security)

{{reflist}}

• {{cite journal |last1=Ozdenizci |first1=Bulent |last2=Ok |first2=Kayhan |last3=Coskun |first3=Vedat |year=2016 |title=A tokenization-based communication architecture for HCE‑enabled NFC services |journal=Mobile Information Systems |publisher=Hindawi |volume=2016 |pages= 1–20|doi=10.1155/2016/5046284|doi-access=free }}

Category:Database security

Category:Cryptography