Network tokenization replaces a stored card number with a token issued by the card network, such as Visa Token Service or the Mastercard Digital Enablement Service (MDES). The token works only for one merchant, the network keeps it current when the card is reissued, and each online payment carries a one-time cryptogram. Platforms reach network tokens through a token requestor: their acquirer, gateway or orchestration layer.
What a network token is
A primary account number (PAN) is the 15- or 16-digit number on a card. Any merchant can charge it, which is why stolen PANs are valuable. A network token is a substitute value issued under the EMV Payment Tokenisation framework that EMVCo, the card industry’s standards body, maintains. EMVCo describes the token as constrained in how it can be used: to a specific merchant, device or payment scenario.
Two kinds of token are easy to confuse:
| Gateway or PSP token | Network token | |
|---|---|---|
| Who issues it | The payment service provider (PSP) or vault that stored the card | The card network’s token service (Visa, Mastercard, American Express) |
| Where it works | Only with the service that created it | With any acquirer or PSP that processes that network’s cards, per Gr4vy’s documentation |
| Card reissued or expired | Needs a separate account updater | The network updates the token |
| Sent in the authorization | The PSP swaps it back to the PAN | Sent to the network in place of the PAN, with a cryptogram |
Wallet tokens, such as a card added to Apple Pay, are network tokens too. This guide covers card-on-file tokens: cards a merchant or platform stores for repeat and recurring payments.
How a token payment flows
Visa’s Token Service fact sheet sets out the sequence:
- The merchant submits the network token to its acquirer.
- The acquirer passes the token to Visa.
- Visa looks up the PAN in its token vault and checks that the token is being used by the right party.
- Visa sends the PAN and the token to the issuing bank, which approves or declines.
- Visa swaps the PAN back to the token in the response to the acquirer and merchant.
The merchant never receives the PAN back. For online payments, the request also carries a cryptogram, a one-time value generated for that transaction. Adyen’s API names it the token authentication verification value (TAVV).
What the networks report
The figures below are the networks’ own, with their dates. They are averages across markets, not a forecast for any one merchant.
| Network | Figure | Date |
|---|---|---|
| Visa | More than 10 billion tokens issued since 2014; more than 8,000 issuers enabled | June 4, 2024 |
| Visa | Over 1.5 million e-commerce merchants transacted with Visa tokens every day in the prior 12 months | June 4, 2024 |
| Visa | Tokenization raised payment approval rates by six basis points globally; Visa says it can cut fraud by up to 60% | June 4, 2024 |
| Mastercard | Three in five Mastercard e-commerce transactions in Europe are tokenised | June 1, 2026 |
| Mastercard | Merchant tokenisation (Secure Card on File) live in 45 European countries and territories | June 1, 2026 |
| Mastercard | Goal of 100% e-commerce tokenisation in Europe by 2030, first announced on June 11, 2024 | June 1, 2026 |
Token requestors and the TRID
To get network tokens, a merchant needs a token requestor that is connected to each network’s token service, and a Token Requestor ID (TRID) per network. Spreedly’s documentation lists the three requirements: a token requestor integrated with the network’s token service, a merchant-specific TRID for each network, and a gateway that accepts network token transactions.
Most platforms do not integrate with Visa and Mastercard directly. Their provider acts as the token requestor on their behalf. The providers below publish how they do it:
| Provider | Role it describes | What its documentation adds |
|---|---|---|
| Stripe | Requests and maintains tokens with Visa, Mastercard and American Express for Stripe Payments users | Works without extra integration; keeps the PAN to retry a failed token payment; lists 16 markets, counting the EU as one |
| Adyen | Manages tokens for you, or accepts tokens you collect yourself | Only for payments Adyen acquires; US co-badged debit tokens can be routed to Accel, Maestro USA, NYCE, PULSE or STAR |
| Visa Acceptance Solutions (Cybersource) | Token Management Service with a TRID per network: Visa, Mastercard and American Express | A request can set the token option to “ignore” to pay on the PAN instead |
| Spreedly | Token Requestor Token Service Provider (TR-TSP) with Visa and Mastercard | Pairs the token and the PAN in one vault token; lists 21 gateways that accept its network tokens |
| Primer | Technical service provider that registers the merchant’s TRID; Visa and Mastercard only | Activation can take up to 48 hours on the network side |
| Gr4vy | Provisions tokens for use across the payment services it connects | Synchronous or asynchronous provisioning, to limit added latency on a first payment |
| IXOPAY (TokenEx) | On-behalf-of token requestor (OBOTR) | Its own token stays as a PCI fallback when a network token cannot be issued |
Stripe and Adyen bundle tokens with their own processing. The vault and orchestration providers keep the token next to the PAN so a merchant can send it to several processors, which is the portability argument covered in payment orchestration.
What changes for a platform
Recurring and stored-card payments. When a bank reissues a card, the network updates the token. Mastercard gives the example of a subscription that keeps working after the old card expires. Stripe says its network tokens work alongside its Card account updater.
Approval rates. The networks report higher approval rates for token payments, as listed above. Spreedly’s help center notes that issuer adoption differs by region, so results vary by where cardholders bank.
Cost. Stripe says that for businesses on custom interchange pricing, a network token is often cheaper to use than a PAN or a PSP token, because of network costs.
Latency. Each online token payment needs a fresh cryptogram from the network. Stripe says this can add latency; Gr4vy offers asynchronous provisioning so a first payment does not wait for the token.
Fallback. Not every gateway or issuer accepts tokens. Spreedly, IXOPAY and Stripe keep the PAN or a PCI token alongside, so a payment can fall back to the card number.
PCI scope. Gr4vy notes that, unlike a PAN, a network token cannot be used at another merchant. Adyen treats network tokens as non-sensitive and lets merchants store them, but a platform that also stores PANs stays in scope for those.
Questions to ask a provider
- Are you the token requestor, and is the TRID registered in our name or yours?
- Which networks and which markets do you provision tokens for today?
- Can we export our network tokens and TRIDs if we change processor?
- What happens when a token payment is declined: do you retry on the PAN?
- Do you send us lifecycle events, such as a token update or suspension, by webhook?
- Does token use change our interchange or your fees, and is that written in the contract?
