What is a network token in payments?

A substitute card number issued by Visa (VTS) or Mastercard (MDES) in place of the real PAN, tied to one merchant, wallet or device and used with a one-time cryptogram. The scheme updates it when the card is reissued, so stored credentials keep working and a stolen token is useless elsewhere.

How a network token differs from a PSP token

A network token is known to the issuer, carries a cryptogram, and is updated at the source. A PSP or gateway token is different: it is a reference in one provider’s vault that still maps to the stored PAN. It takes the merchant out of PCI scope but does nothing for the issuer, which still sees a PAN. The two coexist: most PSPs store a network token behind their own vault token.

How do network tokens work?

At first payment or when a card is saved, the token requestor sends the PAN to the scheme’s token service. The issuer approves, and the scheme returns a token in a dedicated token BIN range, plus an expiry. For each transaction, the token requestor obtains a cryptogram that proves the token is used in its intended domain. The scheme maps the token back to the PAN before forwarding to the issuer, so the merchant, PSP and acquirer never need the PAN again.

More detail in our #PayDecoding episode on Network tokens.