Tokenization
Last updated:October 4, 2024
In today’s digital landscape, merchants are constantly seeking ways to protect sensitive customer data and enhance
their business operations. Tokenization is a powerful tool that not only secures card data but also enables seamless
omnichannel experiences. This guide will help you understand tokenization and choose the right type for your business
needs.
Understanding Tokenization
Tokenization is the process of replacing sensitive data, such as a cardholder’s primary account number (PAN),
with a secure token stored in a token vault. This ensures that sensitive data is not kept in the merchant’s environment,
reducing PCI compliance obligations and costs. In the event of a breach, sensitive data remains protected, maintaining
consumer trust.
Choosing the Right Token for Your Business
Different types of tokens serve different purposes. Here’s a guide to help you decide which tokenization solution best
fits your business needs:
Registration Tokens: Simplifying Online Transactions
Business Scenario
Imagine you run an online store and want to offer your customers the convenience of one-click checkout.
Registration Tokens are your solution.
Benefits:
- Simplifies PCI Compliance: By removing sensitive data from your environment, Registration Tokens help you meet PCI compliance requirements more easily.
- Enhances Security: Reduces the risk of data breaches by not storing sensitive card data.
- Improves Customer Experience: Speeds up the checkout process, making it more convenient for customers.
Example
A customer shopping on your online store can save their card details securely using a Registration Token.
The next time they shop, they can complete their purchase with just one click, without having to re-enter their card details.
This convenience can lead to increased customer satisfaction and loyalty.
Omni Tokens: Enabling Omnichannel Loyalty Programs
Business Scenario
Suppose you operate both an online store and several physical locations like Starbucks. You want to provide
a unified loyalty program that rewards customers for their purchases across all channels. Omni Tokens are designed for this purpose.
Benefits
- Enhances Customer Retention: Enables omnichannel loyalty programs, encouraging repeat business.
- Simplifies Multi-Channel Payment Processing: Use a single token for both online and in-store transactions.
- Provides a Seamless Shopping Experience: Customers enjoy a consistent experience across all channels.
Example
A customer earns loyalty points whether they purchase a coffee online or in-store. Omni Tokens allow you to track these
purchases and reward the customer based on their total spending, providing a seamless and rewarding shopping experience.
Network Tokens: Enhancing Security and Efficiency
Business Scenario
Imagine you run a global eCommerce platform. You face the constant challenge of
reducing fraud and ensuring high transaction approval rates. Network tokens, provided by card networks
like Visa or Mastercard, can be a game-changer.
Challenges Resolved by Network Tokens
Out-of-date Accounts
One of the biggest challenges in eCommerce is dealing with stored card details that become unusable when cards are
lost, stolen, or expired. This often leads to cart abandonment, as studies indicate that 35% of cardholders stop
shopping after their card has been declined once. Network tokens address this issue by being proactively updated
in real-time by issuing banks. This means that lost, stolen, or expired cards become irrelevant, allowing customers
to continue using one-click checkout without interruptions. For subscription-based models, this is particularly
beneficial as it protects recurring payments and reduces operational costs associated with contacting consumers
about expired cards.
Increased Fraud
Merchants in the United States lost about $3.75 for every dollar of online fraud in 2022, with costs increasing
nearly 20% compared to 2019. Fraudsters have shifted to card-not-present transactions, increasing the burden on
merchants. Network tokens help mitigate this by involving the issuer in the approval process, shifting the risk
assessment and liability from the merchant to the issuer. This reduces the cost of fraud and enhances security
across the payment ecosystem. By ensuring that fraud at one merchant does not affect other merchants using the
same PAN, network tokens build a more secure and trustworthy environment.
False Declines
Authorization rates for merchants often remain below 90%, with false declines leading to lost sales and customer
dissatisfaction. Network tokens can significantly improve acceptance rates by involving the issuer in the token
approval process. This higher level of trust reduces declines due to outdated card information, ensuring seamless
transactions and reducing involuntary churn, especially for subscription businesses. By keeping card details up to
date, network tokens enhance the overall customer experience.
Card Data Protection
Payment card data can be stolen at various points, including where it is entered, stored, or transmitted. Network
tokens reduce the value of underlying sensitive data, adding an invisible layer of security. Cardholder-initiated
transactions require a dynamic cryptogram, which further enhances security. This makes it difficult for criminals
to use stolen credentials fraudulently, ensuring secure transactions and protecting both merchants and consumers.
Too Much Friction
With Strong Customer Authentication (SCA) requirements in Europe, card-based payments have become more secure but
also more cumbersome for consumers. The additional security checks have introduced friction, leading to approval
rate declines. Network tokens can be used for 3D Secure authentication, allowing issuers to silently authenticate
cardholders and go frictionless without triggering any challenge process. This reduces friction in the checkout process,
improving the customer experience and maintaining high approval rates.
Increased Costs
Merchants pay interchange fees as part of the merchant discount rate (MDR), which can be substantial. Visa and
Mastercard have adjusted these fees to encourage the use of network tokens. Visa, for instance, offers reduced
interchange fees by up to 10 basis points for transactions using network tokens, while increasing fees for PAN-based
transactions. At high transaction volumes, the cost savings from using network tokens can be significant, making them
a financially attractive option for merchants.
Benefits
- Reduces Fraud: Secure tokens replace sensitive card details, reducing the risk of unauthorized use.
- Improves Authorization Rates: Involving the issuer in the tokenization process leads to higher transaction approval rates.
- Enhances Customer Experience: Keeps card details up to date, ensuring smooth transactions.
- Cost Savings: Reduces fraud-related losses and lowers interchange fees.
- Compliance: Helps merchants comply with PCI DSS by minimizing the storage of sensitive card data.
Tips for getting started
-
3D Secure: Using 3D Secure with network tokens can shift the liability for fraudulent transactions
to the issuer, providing an extra layer of security.
-
Real-Time Account Updater: Ensures you have the most current card details, even though network
tokens update dynamically.
-
Onboarding: Each card scheme requires separate onboarding. Ensure you onboard with each scheme
individually to fully leverage network tokens.
Example
Consider a scenario where a customer’s card is stolen. With traditional card-on-file methods, the merchant
would need to manually update the card details, which could lead to service interruptions and potential fraud. However,
with network tokens, the token updates automatically, ensuring that the customer’s service continues uninterrupted and
the risk of fraud is minimized.
External Tokens: Secure Processing with Acquirers
Business Scenario
Consider you accept payments through an acquirer that generates its own tokens. External Tokens
allow you to securely process payments and store tokens for future transactions with the same acquirer.
Benefits
- Enhances Security: Uses tokens generated by trusted acquirers, reducing the risk of data breaches.
- Simplifies Payment Processing: Streamlines transactions with specific acquirers.
- Flexible Token Storage: Tailored to your business needs, allowing for various storage options.
Example
When a customer makes a purchase through your store, an External Token is generated. This token can be stored and used
for future transactions with Square, ensuring secure and efficient payment processing.
ApplePay Tokens: Seamless Payments for Apple Device Users
Business Scenario
Imagine you run an online store that caters to a large number of Apple device users.
Apple Pay tokens can provide a seamless and secure payment experience for your customers.
Benefits
-
Enhanced Security: Apple Pay tokens replace sensitive card details with secure tokens,
reducing the risk of unauthorized use. Each transaction is authorized with a one-time unique dynamic security code.
-
Improved Customer Experience: Apple Pay tokens streamline the checkout process for Apple
device users, allowing them to complete purchases quickly and easily using Face ID, Touch ID, or their device passcode.
-
Increased Trust: Customers are more likely to trust and use a payment method that is known
for its security and ease of use, potentially increasing your sales.
Example
A customer shopping on your online store using their iPhone can use Apple Pay to complete their purchase with just
a touch or a glance. The Apple Pay token ensures that their card details are never shared with the merchant, providing
a secure and convenient payment experience.
Tokens Formats
Tokens come in two main formats:
-
Non-card format preserving. The token format is different from the sensitive information it replaces.
For example, a
Registration Token
is converted into a universally unique identifier (UUID) in a random alphanumeric format.
-
Card format preserving. The token maintains the same format as the original PAN, but the values are
randomly changed. For instance, an
Omni Token
keeps the first 6 digits (BIN) and last 4 digits similar to the original card number. This format is useful
for loyalty programs and one-click checkout payment widgets.
Token Type |
Token Format |
Description |
Interactive Guide |
Registration Token |
123e4567-e89b-12d3-a456-426614174000 |
A UUID, a universally unique identifier in a random alphanumeric format. |
COPYandPAY
Server-to-server
|
Omni Tokens |
123456XXXXXX3456 |
Preserves the first 6 digits (BIN) and last 4 digits of the original PAN. |
COPYandPAY
Server-to-server
|
Network Tokens |
654321XXXXXX7890 |
A card format token where the first 6 and last 4 digits are randomized. |
COPYandPAY
Server-to-server
|
External Tokens |
A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6 |
A random alphanumeric string generated by the acquirer. |
COPYandPAY
Server-to-server
|
ApplePay Tokens |
Encrypted JSON object |
Contains encrypted payment data, including payment method and transaction identifier. |
COPYandPAY
|
Conclusion
Choosing the right tokenization solution depends on your specific business needs. Whether you need to enhance security,
simplify PCI compliance, improve customer experience, or streamline payment processing, understanding the different
types of tokens and their benefits can help you make an informed decision. Tokenization is not just about securing
data; it’s about creating a better, more efficient experience for both you and your customers.
See also