TokenizationMaximizing Data Security for Merchants & Cardholders

Tokenization: Why is This Now the Standard for Data Security?

Wouldn’t it be great if you had a decoy version of yourself that you could project online? Fraudsters that might be hunting for your personal information would pursue the decoy, while you go about your business unbothered. Well, in a sense, that’s the basic idea behind payment tokenization

With tokenized data, valuable transaction information stays protected. A one-time-use token, which will be totally useless to a scammer, is the only thing that is ever exposed. And, there is a practically infinite number of disposable tokens available.

That’s the simplified explanation, but what are tokens, exactly? Where do they come from? Are they really safe? In this post, we’ll cover how tokenization works, and why it’s one of the most secure data protection methods available.

What is Payment Card Tokenization?

Tokenization

[noun]/tō ● kən ● uh ● zey ● shuhn/

Tokenization refers to the process of protecting sensitive data by replacing it with a randomized placeholder number called a token.

Tokenization is the process of substituting a sensitive data element for a non-sensitive equivalent. An individual credit card token is an algorithmically generated alphanumeric code that serves as a proxy for real transaction data.

What’s that mean? Well, an easy way to explain this is to think back to when you were a kid.

You might’ve gotten a few bucks from your allowance, and so you decide to spend them at a video arcade. You walk into the arcade, insert a dollar into a machine, and in return, you receive a handful of arcade tokens. The little coins could be used in place of cash for games in the arcade, but they had no intrinsic value of their own.

Sure, it’s a silly metaphor… but it’s also an easy way to understand tokenization:

Arcade Token	Payment Token
No intrinsic value on its own	No intrinsic value on its own
Works only at the designated arcade	Works only for the designated transaction
Restricts access to cash	Restricts access to transaction data
Gone after one use	Gone after one use

Tokenization cannot guarantee that transmissions won’t be hacked. If a hack occurs, however, the hacker would only score a random, valueless group of numbers, rather than one’s personal information.

How Does Payment Card Tokenization Work?

Sensitive consumer information like names and account numbers are replaced by a tokenized code. This allows data to move between networks without revealing customer details.

In a transaction involving payment card tokenization, for example, the cardholder’s primary account number (PAN) is exchanged for an algorithmically-generated token. A PAN of 1234 5678 9123 4567, for example, might end up with a completely random token like 3M747T4567.

The token is tied to the real account number, of course (the last four digits are usually the same). However, the customer’s actual data remains in a tokenization “vault;” a guarded database usually secured by a third-party vendor. Banks will know who the token represents, but merchants (and anyone else) looking at the data will see only the token.

Tokens are good for one use only. Once transmitted, the token is no longer valid. As this illustration shows, even if a customer uses the same card to make an identical purchase from the same merchant, the tokens connected to the transaction would be unique.

While specific details may vary, a typical tokenized credit card transaction might go through the following steps:

• The cardholder “dips” their payment card information to make a purchase.
• Cardholder data is substituted for a randomized, one-time-use token.
• The token is sent to the merchant’s acquiring bank in place of actual card information.
• The acquirer requests authorization based on the profile attached to the token.
• The customer’s issuing bank validates the token. If it matches, the purchase can be authorized.
• The issuer responds, using the token as a point of reference.
• The purchase is completed using the attached token as a unique transaction identifier.
• The token expires.

Tokenization can be deployed in a variety of situations:

What's the Difference Between Tokenization & Encryption?

Tokenization is sometimes confused with another security protocol, end-to-end data encryption (or “E2EE”). The two have similarities, but they’re not the same thing.

From a security standpoint, the most important distinction is that encryption can be mathematically reverse engineered (at least in theory). Under the right conditions, even encrypted account data could be exposed by an advanced decryption tool.

Encrypted data uses a complex algorithm, combined with an encryption key that works like a cypher to revert the data to its original state. So, if a hacker manages to compromise the key, they can read the transmission. That can’t happen with tokenization, though.

Tokenization completely removes transaction data from the equation, and replaces it with a token. Even if a criminal somehow managed to “hack” a particular token, there’s no information there to reverse engineer. The risk of data theft is effectively eliminated.

The Benefits of Tokenization

As we’ve pointed out, the primary benefit of tokenization is data security. But there are also a few more perks to consider, too:

Are There Downsides to Tokenization?

Tokenization is powerful, but it’s not a perfect solution. The technology adds a layer of complexity to a merchant’s IT structure, which may require additional expert technical support. 

Also, not all payment processors support tokenization yet. A merchant may have to change vendors or systems, and may get stuck with a less efficient solution than they would like.

All that said, the biggest disadvantage to tokenization is probably what it doesn’t offer: comprehensive fraud protection.

Merchants often believe that extra data security means decreased fraudulent activity. It doesn’t work that way, though; tokenization reduces overall data security risk, but not fraud risk. This is especially true in the card-not-present space, where tokenization may not be an option, and where sellers cannot validate buyers’ identities in person.

Bottom line: even when handling tokenized data, merchants are still vulnerable to unauthorized transactions and the accompanying chargebacks.

Considerations When Implementing Tokenization

Tokenization generally makes transactions safer and less vulnerable to hacking. However, there are points that merchants will need to consider before implementing tokenization technology.

By replacing sensitive debit card data with unique identifiers, tokenization is a powerful, cost-effective way to offer cardholders maximum transaction security. But, as we explained above, that still may not be enough.

Overall fraud protection requires an even broader strategy, one that addresses data security, fraud prevention, and post-transaction revenue recovery. That’s why the most effective method for keeping information safe is a combined approach that would include encryption, tokenization, and other secure practices.

If you’d like to learn more about keeping both your data and your revenue safe, let us know. Chargebacks911® offers turnkey services designed to produce long-term, sustainable growth.