Токенизация карт
Card Tokenization
Card tokenization replaces the card number (PAN) with a surrogate token that is useless outside a specific environment and does not reveal the actual card data.
What is Токенизация карт (Card Tokenization)?
Card tokenization replaces sensitive payment data, primarily the card number, with a surrogate value. The token is accepted within a defined system, such as a specific merchant, a payment gateway, or an issuer's network, but it cannot be used to recover the original PAN without access to the mapping stored in the vault.
## How it works
When a card is paid for or saved for the first time, the data is passed to a tokenizer. This can be a PSP vault, a payment gateway, or a token service provider. The tokenizer returns a token, while the original card number stays in its secure storage. From then on, the business works only with the token: charges, recurring payments, and refunds are processed using it.
## Types of tokens
Merchant or PSP tokens are tied to a single business and usually cannot be transferred between businesses. Network tokens are issued by card schemes and linked to the card at the network level. When a card is reissued or its number changes, they can be updated without the customer's involvement. This reduces declines caused by outdated card data.
## Impact
Tokenization reduces the amount of data that reaches the merchant's infrastructure, which makes it easier to meet PCI DSS requirements. It also helps preserve approvals for recurring charges and subscriptions. Combined with 3-D Secure and network tokens, it lowers the fraud risk on repeat payments.
## Common mistakes
A common mistake is treating a token as a replacement for all security requirements. Tokenization reduces the audit scope but does not remove the need for channel protection, access control, and logging. Another mistake is tying tokens to a single PSP without a migration plan, which forces teams to recollect card details from customers when the provider changes.
FAQ
Are card tokenization and encryption the same thing?
No. Encryption turns data into an unreadable form that can be decrypted with a key. A token does not contain the original card number, and the PAN can be recovered only through the tokenizer's vault.
How does a network token differ from a PSP token?
A network token is issued by the card scheme and linked to the card at the network level, so it can be updated when the card is reissued. A PSP token usually works only within the PSP's own infrastructure.
Does tokenization remove the obligation to comply with PCI DSS?
Not entirely. It reduces the scope of assessment, but the merchant still has to meet the requirements for protecting its own systems and processes.