Network tokenization
Replace stored card numbers with scheme-issued tokens that update themselves when the underlying card is reissued.
Network tokenization is the replacement of a card's primary account number (PAN) with a token issued by the card scheme itself — Visa, Mastercard, American Express — rather than by a payment processor. Because the scheme maintains the link between token and card, the token keeps working when the card behind it is reissued, replaced or renumbered.
Why stored cards decay
Every card on file has a shelf life. Cards expire, get replaced after fraud, get reissued when a bank changes BIN ranges. For a subscription business, that decay shows up as involuntary churn: customers who wanted to keep paying and were not asked to, because the stored credential silently stopped working.
A network token does not decay the same way. The scheme keeps it pointed at the current card. When the card behind it is reissued, the token you hold continues to work — no email to the customer, no re-entry, no failed renewal.
Processor tokens and network tokens are not the same thing
A processor token is a reference your provider issues so you do not have to store the PAN. It solves a compliance problem: the card number lives in their vault rather than your database. What it does not do is survive the card being reissued, and it is usually only meaningful to that one provider — which makes moving providers painful.
A network token is issued by the scheme. It survives reissuance, it is recognised across providers, and issuers can see that the transaction carries one — which is why it tends to be treated as a lower-risk transaction than a raw PAN.
What changes when you tokenize
- Stored credentials keep working through card reissuance and renumbering.
- The PAN leaves your systems entirely, narrowing PCI DSS scope.
- Issuers can distinguish a tokenized transaction from a raw card number.
- A compromised token is useless outside the merchant it was issued for.
- Tokens are not locked to one processor, so switching providers does not mean re-collecting cards.
Tokens plus an account updater
Network tokens cover cards that were reissued. A real-time account updater covers the rest of the failure modes — cards closed, expired or replaced in ways the token cannot follow on its own. Run together, they are the difference between chasing failed renewals and not having them.
Common questions
What is network tokenization?
Network tokenization replaces a card number with a token issued by the card scheme — Visa, Mastercard, Amex — instead of by a processor. The scheme maintains the link to the underlying card, so the token keeps working after the card is reissued or renumbered.
What is the difference between a network token and a processor token?
A processor token is issued by your payment provider and is generally only usable with that provider; it stops working when the card is reissued. A network token is issued by the card scheme, survives reissuance, and is portable across providers.
Does network tokenization reduce PCI DSS scope?
It helps, because the primary account number no longer needs to be stored in your systems. It does not remove your PCI obligations by itself — how you collect the card in the first place still determines which SAQ applies to you.
Do network tokens work for recurring payments?
Yes, and that is where they matter most. Subscriptions fail when a stored card is reissued and nobody notices until the renewal declines. A network token keeps pointing at the current card, so the renewal goes through without contacting the customer.
Do I need to re-collect card details to start using tokens?
No. Existing stored cards can generally be provisioned into network tokens without asking customers to re-enter anything.
Related
Ready to take control of your payments?
Talk to our team. We’ll walk you through the dashboard and answer the awkward questions.