Tokenization swaps a sensitive number, like a card's 16 digits, for a surrogate value called a token that has no value if stolen. The real number is kept in a secure vault, and merchants, gateways, and apps handle only the token. This shrinks the amount of raw card data flowing through systems, which reduces both breach risk and compliance scope. Network tokenization (offered through schemes like Visa and Mastercard via EMVCo standards) also lets tokens update automatically when a card is reissued, so saved-card and wallet payments keep working.
In a flow
Tokenization is a message-layer protection, not a money movement. It changes what data travels through the authorization and storage steps (a token instead of the real number); the actual funds still move through banks during clearing and settlement, unaffected by the swap.
Common misconceptions
Myth: Tokenization is the same as encryption.
Reality: Encryption scrambles data that can be unscrambled with a key. Tokenization replaces the number with an unrelated stand-in that has no mathematical link to the original, so a stolen token cannot be reversed into a card number.
Myth: A token can be used anywhere, like a real card number.
Reality: Tokens are typically restricted, often to a specific merchant, device, or use. A token captured in one place generally cannot be replayed elsewhere, which is a core part of why it reduces fraud value.
Related terms
See it in a guide
Sources
- EMVCo Payment Tokenisation specifications ↗ · EMVCo (operator). The cross-network standard for payment tokens.
- Visa Token Service ↗ · Visa (operator). Network tokenization for saved cards and wallets.
- Mastercard rules and standards ↗ · Mastercard (operator). Network rules covering tokenized transaction processing.
Educational, plain-English explainers. Not legal, compliance, tax, or financial advice. These cover fundamentals, not current fees, limits, or rates (which change). Rails and parties vary by program and country, so verify specifics against primary sources. Last reviewed June 2026.