What is the difference between a network token and a PSP token?
A PSP token is a reference to a card stored in one provider’s vault; the issuer still sees the PAN. A network token is issued by the scheme, known to the issuer, carries a cryptogram and is updated when the card changes. Most providers store a network token behind their own vault token.
In detail
A PSP token is a reference to a card stored in one provider’s vault; the issuer still sees the PAN. A network token is issued by the scheme, known to the issuer, carries a cryptogram and is updated when the card changes. Most providers store a network token behind their own vault token.
What is a network token, and how is it different from a PSP token?
EMVCo’s tokenization framework replaces the PAN with a unique alternative value, an EMV Payment Token, constrained to specific devices, merchants or use cases through token domain restriction controls. Three roles define the system: the token service provider (the scheme, or an issuer-appointed provider) that issues and maps tokens, the token requestor (a merchant, PSP, wallet or platform) that asks for them with a registered Token Requestor ID, and the issuer that approves each provisioning. EMVCo keeps the registry of token service providers and BIN controllers.
How do network tokens work?
The scheme maps the token back to the PAN before forwarding to the issuer, and maps the response back. The merchant, PSP and acquirer never need the PAN again.
More detail in our #PayDecoding episode on Network tokens.