Network token is a substitute card number issued by a card scheme's token service, such as Visa Token Service or Mastercard MDES, that replaces the real card number for a specific merchant or device. It looks like a normal 16-digit number and travels through the same authorization messages, but works only for the token requestor and channel it is bound to. The scheme stores the token-to-PAN mapping, validates a one-time cryptogram on each payment and swaps the token back before forwarding to the issuer. Issuers update the mapping when cards are reissued, so stored credentials keep working, approval rates tend to rise and fraud falls. Unlike PSP tokens, network tokens work through any token-enabled acquirer.
What is a network token
The network token is created and managed by the scheme acting as token service provider, under the EMVCo Payment Tokenisation specification. Each token is bound to a token requestor (a merchant, PSP or wallet) and often to a channel, so a token stolen from one online store's database cannot be used at another store or at a terminal. Visa launched its token service in 2014, the same year Apple Pay went live on network tokens.
How does network tokenization work
- A merchant or its PSP, registered as a token requestor, sends the primary account number to the scheme's token service.
- The scheme asks the issuer to approve provisioning, and the issuer may run a check on the cardholder.
- The scheme returns a token and stores the token-to-PAN mapping in its vault.
- For each payment, the merchant requests a one-time cryptogram and sends it with the token in the authorization.
- The scheme validates the cryptogram, swaps the token back to the PAN (detokenization), and forwards the request to the issuer.
Why merchants adopt network tokens
The biggest gain is lifecycle management. When a card expires or is reissued after loss, the issuer updates the mapping and the token keeps working. A subscription business with 100,000 stored cards that loses 1% of them a month to reissues would otherwise face about 1,000 involuntary declines monthly.
Issuers also see the cryptogram as proof the credential came from a registered requestor, so tokenized card-not-present transactions tend to get higher approval rates and lower fraud. Some schemes charge lower fees on tokenized traffic. Stored network tokens are not PANs, which reduces the data at risk in a breach, although a merchant that also stores PANs remains in full PCI DSS scope.
Network token vs payment token
A PSP payment token is a reference to a PAN held in the PSP's own vault. It is worthless outside that PSP, which creates lock-in: switching processors means migrating the card data. A network token is recognised by the scheme, so it can be processed through any acquirer that supports tokens and survives card reissues.
The two are often layered. The PSP issues its own token to the merchant and, behind it, holds a network token that it sends to the scheme.
What buyers look at
For a PSP or subscription business being acquired, the share of stored credentials held as network tokens, which entity is the registered token requestor, and whether those tokens transfer to a new owner all affect post-deal approval rates and churn.