Merchant tokenization

What is merchant tokenization

Merchant tokenization is a security capability that replaces a cardholder's PAN with a unique network token specific to a single merchant.

Merchant tokenization differs from digital wallet tokenization in one key way. Digital wallet tokenization starts when a user adds a card to a wallet. Merchant tokenization is driven by the merchant when a user saves their card on file for future use.

How it works

%%{init: {'theme': 'base', 'themeVariables': {'actorBkg': '#ffffff', 'actorTextColor': '#333333', 'actorBorder': '#333333'}}}%%
sequenceDiagram
    box rgba(163, 230, 247, 0.3)
        participant CH as 🧑 Cardholder
    end
    box rgba(123, 186, 237, 0.3)
        participant M as 🏪 Merchant
    end
    box rgba(37, 125, 201, 0.3)
        participant PP as 🔄 Payment Processor
    end
    box rgba(37, 56, 201, 0.3)
        participant CN as 🌐 Card Network<br/>(Visa / Mastercard)
    end
    box rgba(6, 144, 250, 0.3)
        participant IS as 🏦 Issuer
    end

    Note over CH,IS: 1️⃣ Initiation

    CH->>M: Enters card details (PAN)<br/>e.g., Netflix, Amazon
    M->>M: Cardholder saves card<br/>for future billing

    Note over CH,IS: 2️⃣ Token Request

    M->>PP: Requests network token
    PP->>CN: Forwards token request<br/>(includes raw PAN)
    CN->>IS: Validates card &<br/>requests approval
    IS-->>CN: Approves tokenization
    CN-->>PP: Returns network token<br/>(replaces raw PAN)
    PP-->>M: Delivers token

    Note over CH,IS: 3️⃣ Storage

    M->>M: Stores merchant token<br/>in place of sensitive<br/>card number in database
    Note right of M: Raw PAN is discarded —<br/>only token is retained

    Note over CH,IS: 4️⃣ Transacting

    M->>CN: Submits payment using token<br/>+ unique cryptogram
    CN->>CN: Validates cryptogram<br/>(ensures token is bound<br/>to this merchant)
    CN->>IS: Forwards transaction<br/>with original PAN
    IS-->>CN: Approves / Declines
    CN-->>M: Transaction result
    M-->>CH: Payment confirmed

    Note over CN: 🔒 Stolen token cannot<br/>be used elsewhere —<br/>cryptogram is merchant-specific

    loop Recurring & One-Click
        M->>CN: Future payment with<br/>same token + new cryptogram
        CN-->>M: Validated & processed
    end

1. Initiation

A cardholder enters card details at an online merchant or subscription service. For example, Netflix or Amazon. The user saves the card for future billing.

2. Token request

The merchant or their payment processor requests a network token. The request goes to the card network (Visa or Mastercard). The DPAN (Device Primary Account Number) token replaces the raw PAN (Primary Account Number).

3. Storage

After the issuer approves, the merchant stores the token. The merchant token replaces the sensitive card number in their database.

4. Transacting

The merchant uses this token for all future payments. This covers recurring charges and one-click purchases. Each transaction includes a unique cryptogram. The network validates this cryptogram, ensuring that a stolen token cannot be used elsewhere.

Key benefits

Security: The network restricts the token to a specific domain. The token only works at the merchant that requested it. Other merchants cannot use a stolen token.

Lifecycle management: When a cardholder loses or reissues a physical card, the network automatically updates the merchant token. Services like VAU/ABU handle this. Subscriptions continue without interruption.

Control: Issuers can view and manage tokens individually. Suspend a specific subscription token without canceling the physical card.