Quick answer
In payments, tokenization is a process that replaces the primary account number (PAN), your long card number, with a surrogate value called a token[2]. Payment tokens can be restricted to a specific merchant, device or payment scenario, so a stolen token is worth far less than a stolen card number[1].
Key points
- A token stands in for your real card number, so systems that only see the token hold less valuable data.
- EMV payment tokens can be limited to one merchant, one device or one type of payment.
- Tokenization reduces risk and PCI DSS scope, but it does not remove the need for security compliance.
On this page
#How does a payment token work?
EMVCo, the body that manages EMV payment specifications, says payment tokenisation removes the most valuable data to a fraudster, the primary account number, and replaces it with a unique alternative value, the EMV Payment Token[1]. That token is constrained in how it can be used, for example to a specific merchant, device or payment scenario[1]. Swapping the token back for the real number is called de-tokenization, and the secure store that maps tokens to card numbers is often called the card data vault[2].
Worked example
Example: a token in a phone wallet
Mia adds her bank card to the wallet on her phone. Instead of storing her 16-digit card number on the phone, the wallet receives a token that only works for payments from that device. If a shop's systems were later breached and the token stolen, the criminal could not simply type it into another website as if it were Mia's real card number.
- What the shop sees
- A token, not Mia's real card number
- Where the token works
- Payments from Mia's registered phone
- Where the link to the real card is kept
- In a secure token vault, not in the shop's systems
#Does tokenization replace other security rules?
No. The PCI Security Standards Council says tokenization solutions do not eliminate the need to maintain and validate PCI DSS compliance, but they may simplify a merchant's validation by reducing the number of system components the requirements apply to[2]. Systems that can turn a card number into a token, or a token back into a card number, stay in scope[2].
#Is payment tokenization the same as asset tokenization?
No, the same word is used for two different ideas. Payment tokenization hides a card number behind a substitute value. Asset tokenization records ownership of something, such as a bond or a building share, as a digital token on a ledger; see tokenization of real-world assets. For how tokens fit into everyday payments, read digital wallets explained.
Frequently asked questions
Is a token the same as an encrypted card number?
Not necessarily. PCI SSC guidance notes that tokens produced by reversible encryption are effectively encrypted PANs and may bring extra PCI DSS considerations[2].
Can a stolen payment token be used anywhere?
It is much less useful than a card number, because an EMV payment token is constrained, for example to a specific merchant, device or payment scenario[1].
Sources
- EMV Payment Tokenisation — EMVCo, 2026 Primary
- Information Supplement: PCI DSS Tokenization Guidelines (v2.0) — PCI Security Standards Council, 2011 Primary
