---
title: Digital wallet tokenization
slug: concepts/cards/issuing-models/integrated-issuing/digital-wallet-tokenization
description: Learn how Cross River P1 enables secure Apple Pay, Google Pay, and Samsung Pay provisioning with tokenization, NFC setup, and fraud reduction.
docTags: 
createdAt: 2026-03-11T16:20:36.382Z
---

# What is a digital wallet?

A digital wallet securely stores payment information and credentials for electronic transactions. You don't need physical cards. The benefits include:

### 1. Security benefits (the big win)

- Tokenization returns tokens (not real card numbers) when someone steals data
- Merchant tokens only work in specific places (like one specific phone or one specific merchant)
- Stolen tokens are worthless elsewhere

**Real-world example**

Think of tokens like hotel key cards. If someone steals your hotel key card, they can only open *your* room at *that* hotel. They cannot use it at other hotels or for anything else. Stealing your actual house key would be much worse. That works everywhere.

**Business impact**

- Lower fraud losses
- Fewer customer complaints
- Better security without more work

### 2. Better customer experience

**What it means**

- Add a card to Apple Pay in seconds
- Use the same card on phone, watch, and tablet
- Get automatic updates when cards expire

**Real-world example** 

Before tokenization, your card expiration forced you to update your card number on 15 different websites expired. With tokenization, that happens automatically. Netflix, Spotify, gym membership - all keep working.

**Business impact**

- Fewer failed payments
- Less customer frustration
- Lower support costs

## Card provisioning

Card provisioning is the process of adding a payment card to a digital wallet (Apple Pay, Google Pay, Samsung Pay, etc.). Cross River P1 supports multiple provisioning methods to enable cardholders to securely add their cards to digital wallets.

| Supported networks                                                        | Supported wallets                      |
| ------------------------------------------------------------------------- | -------------------------------------- |
| - Visa Token Service (VTS)
- Mastercard Digital Enablement Service (MDES) | * Apple Pay
* Google Pay
* Samsung Pay |

## Provisioning types

### 1. Manual provisioning

**Description:** Cardholder manually enters card details into the digital wallet app

**Flow:**

```mermaid
%%{init: {'theme': 'base', 'themeVariables': {'noteBkgColor': '#fff3cd', 'noteTextColor': '#333'}}}%%
sequenceDiagram
    box rgba(66, 133, 244, 0.3)
        participant CH as 🧑 Cardholder
    end
    box rgba(52, 168, 83, 0.3)
        participant W as 📱 Wallet App<br/>(Apple Pay / Google Pay)
    end
    box rgba(234, 67, 53, 0.3)
        participant CN as 🌐 Card Network<br/>(VTS / MDES)
    end
    box rgba(142, 36, 170, 0.3)
        participant CR as 🏦 Cross River P1
    end

    Note over CH,CR: 1️⃣ Cardholder Opens Wallet

    CH->>W: Opens wallet app

    Note over CH,CR: 2️⃣ Enters Card Details

    CH->>W: Enters card details
    Note right of CH: • Primary Account Number (PAN)<br/>• Expiry date<br/>• CVV

    Note over CH,CR: 3️⃣ Tokenization Request

    W->>CN: Sends tokenization request

    Note over CH,CR: 4️⃣ Forward to Issuer

    CN->>CR: Forwards request to<br/>Cross River P1

    Note over CH,CR: 5️⃣ Risk Checks & Validation

    CR->>CR: Performs risk checks<br/>and validation

    Note over CH,CR: 6️⃣ Additional Verification

    alt Additional verification required
        CR-->>CH: Requests OTP<br/>(via SMS or email)
        CH->>CR: Submits OTP
    end

    Note over CH,CR: 7️⃣ Token Creation

    CR-->>CN: Approves tokenization
    CN->>CN: Creates and activates token

    Note over CH,CR: 8️⃣ Token Stored

    CN-->>W: Delivers token
    W->>W: Token stored securely<br/>in wallet

    Note over W: 🔒 Token is device-bound<br/>and ready for use
```

1. Cardholder opens wallet app (Apple Pay, Google Pay, etc.)
2. Cardholder enters card details:&#x20;
   - Primary Account Number (PAN)
   - Expiry date
   - CVV
3. Wallet sends tokenization request to card network (VTS or MDES)
4. Card network forwards request to Cross River P1
5. Cross River P1 performs risk checks and validation
6. Cross River P1 may require additional verification (OTP via SMS or email)
7. Upon approval, card network creates and activates token
8. Token is stored securely in the wallet

**Use case:**

- Cardholder adding card for the first time
- Cardholder doesn't have access to partner's mobile app
- Standard wallet provisioning without pre-authentication

**Advantages & disadvantages:**

| Advantages                                                                        | Disadvantages                                                                                          |
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| - Works with any wallet app
- No partner app required
- Standard industry process | * Manual data entry (friction)
* May require additional OTP verification
* Slower provisioning process |

### 2. Tap to provision (NFC provisioning)

**Description:** Cardholder taps physical card to smartphone to provision card to digital wallet

**Flow:**

```mermaid
%%{init: {'theme': 'base', 'themeVariables': {'noteBkgColor': '#fff3cd', 'noteTextColor': '#333'}}}%%
sequenceDiagram
    box rgba(66, 133, 244, 0.3)
        participant CH as 🧑 Cardholder
    end
    box rgba(52, 168, 83, 0.3)
        participant W as 📱 Wallet App
    end
    box rgba(255, 152, 0, 0.3)
        participant PC as 💳 Physical Card<br/>(NFC)
    end
    box rgba(234, 67, 53, 0.3)
        participant CN as 🌐 Card Network<br/>(VTS / MDES)
    end
    box rgba(142, 36, 170, 0.3)
        participant CR as 🏦 Cross River P1
    end

    Note over CH,CR: 1️⃣ Open Wallet App

    CH->>W: Opens wallet app<br/>on smartphone

    Note over CH,CR: 2️⃣ Tap Physical Card

    CH->>PC: Taps physical card<br/>to phone

    Note over CH,CR: 3️⃣ NFC Card Read

    PC-->>W: Phone reads card data via NFC
    Note right of PC: • Primary Account Number (PAN)<br/>• Expiry date

    Note over CH,CR: 4️⃣ Tokenization Request

    W->>CN: Sends tokenization request

    Note over CH,CR: 5️⃣ Forward to Issuer

    CN->>CR: Forwards request to<br/>Cross River P1

    Note over CH,CR: 6️⃣ Validation & Risk Checks

    CR->>CR: Validates card and<br/>performs risk checks

    Note over CH,CR: 7️⃣ Additional Verification

    alt Verification required
        CR-->>CH: Requests OTP<br/>(via SMS or email)
        CH->>CR: Submits OTP
    end

    Note over CH,CR: 8️⃣ Token Created

    CR-->>CN: Approves tokenization
    CN->>CN: Creates and activates token

    Note over CH,CR: 9️⃣ Card Added to Wallet

    CN-->>W: Delivers token
    W->>W: Card added to wallet
    Note over W: 🔒 Ready for contactless<br/>payments

```

1. Cardholder opens wallet app on smartphone
2. Cardholder taps physical card to phone (NFC)
3. Phone reads card data via NFC (PAN, expiry)
4. Wallet sends tokenization request to card network
5. Card network forwards request to Cross River P1
6. Cross River P1 validates card and performs risk checks
7. Cross River P1 may require verification (OTP)
8. Token created and activated
9. Card added to wallet

**Use Case:**

- Quick provisioning without manual data entry
- Cardholder has physical card and NFC-enabled phone
- Alternative to manual entry

**Advantages and disadvantages:**

| Advantages                                                                              | Disadvantages                                                                                      |
| --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| - No manual typing required
- Fast card data capture via NFC
- Works with physical card | * Requires NFC-enabled phone
* Requires physical card in hand
* May still require OTP verification |

**Availability:**

- **Visa:** Supported via Visa Token Service
- **Mastercard:** Supported via MDES
- **Cross River P1:** All cards are contactless-enabled and support Tap to Provision

## Provisioning comparison

| Type                 | User Effort   | Speed | OTP Required? | Partner App Required? | Best For             |
| -------------------- | ------------- | ----- | ------------- | --------------------- | -------------------- |
| **Manual**           | High (typing) | Slow  | Often         | No                    | First-time users     |
| **Tap to provision** | Low (1 tap)   | Fast  | Sometimes     | No                    | Physical card owners |

## Post-provisioning process

After any provisioning method, the following occurs:

1. **Token creation:**&#x20;
   - Card network (VTS or MDES) issues device-specific token
   - Token is cryptographically linked to original card
   - Token is unique to device and wallet combination
2. **Token storage:**&#x20;
   - Token stored securely in device's secure element
   - Original PAN never stored on device
   - Token cannot be extracted or cloned
3. **Token activation:**&#x20;
   - Visa/Mastercard activates token
   - Token status updated in Cross River P1 system
   - Card ready for transactions
4. **Token management:**&#x20;
   - Cross River P1 can suspend, resume, or delete tokens
   - Partner can manage tokens via API
   - Cardholder can manage tokens via wallet app

## Cross River P1 provisioning capabilities

Cross River P1 manages provisioning tasks including:

### 1. Risk checks

- Geolocation validation
- Cardholder verification
- Fraud detection

### 2. Token status updates

- Token activation
- Token suspension
- Token resumption
- Token deletion

### 3. Token lifecycle management

- Monitor token usage
- Track token status
- Process token renewal

## Use cases

### Use case 1: First-time cardholder (manual provisioning)

**Scenario:** New cardholder receives physical card, no mobile app

**Implementation:**

- Cardholder opens Apple Pay or Google Pay
- Manually enters card details
- Receives OTP via SMS
- Completes verification

**Result:**

- Standard provisioning flow
- Additional friction (manual entry + OTP)
- Longer time-to-wallet (minutes)

### Use case 2: Quick provisioning (tap to provision)

**Scenario:** Cardholder has physical card and NFC phone

**Implementation:**

- Cardholder opens wallet app
- Taps card to phone
- Card data captured via NFC
- OTP verification (if required)

**Result:**

- Faster than manual (no typing)
- Moderate friction (tap + possible OTP)
- Medium time-to-wallet

## Network-specific features

### Visa Token Service (VTS)

**Supported Provisioning Types:**

- Manual provisioning
- Tap to provision

**Key Features:**

- Cloud Token Framework (CTF) for connected devices
- Visa Card Enrollment Hub (VCEH) for merchant-initiated provisioning
- Multi-device token management
- Risk-based authentication

### Mastercard Digital Enablement Service (MDES)

**Supported provisioning types:**

- Manual provisioning
- Tap to provision (NFC Provisioning)

**Key features:**

- Remote Notification Service for token status updates
- Token Lifecycle Management
- Multi-device tokenization
- Enhanced security with cryptographic authentication