Explained to kids!
A network token is a stand-in number for a bank card. The shop keeps the stand-in, not the real card number. If a thief finds it, it is useless anywhere else. And when the card changes, the stand-in keeps working.
Let’s see it in real life…
On Sunday, Leila goes to the big museum with her two moms, Mama Inès and Mama Jo.
At the entrance, Mama Jo hands her red coat to the cloakroom. The man gives her a little ticket: number 47.
“Why not just write your name?” asks Leila. “Because then anyone who heard it could come and take my coat,” says Mama Jo. “With the ticket, only this cloakroom, today, knows that 47 means my coat.”
In the dinosaur room, Leila finds a ticket on the floor: number 112. She brings it to the man.
“Can someone use it at the swimming pool cloakroom?” she asks. “No,” he laughs. “It only works here. Everywhere else, it is just a bit of paper.”
The man cancels ticket 112 and writes a new number for the lady who lost it. Her coat stays safe on its hook.
At the end of the visit, Mama Jo shows ticket 47, and the man gives her the red coat straight away.
On the way out, Mama Inès pays for three hot chocolates with her card. “The café did the same thing with my card,” she says. “It keeps a stand-in number, not my real one.”
“And if your card changes?” asks Leila. “The stand-in gets updated. The café never even notices.”
That is a network token.
Tiny recap
- It means… a stand-in number that works in place of the real card number, in one place only.
- It helps when… a shop keeps your card for later, or when your card is replaced and you do not want to type it again.
- Watch out for… a token is not magic: the shop still has to check it is really you paying.
…detailed for specialists
Network tokens are substitute card numbers issued by the card schemes, Visa Token Service (VTS) and Mastercard Digital Enablement Service (MDES), in place of the real PAN. Each token is tied to one merchant, wallet or device, travels with a one-time cryptogram, and is updated by the scheme when the card is reissued, so stored credentials keep working and stolen tokens are worthless elsewhere.
They matter in 2026 because the schemes have stopped treating them as an option. Visa counts more than 16 billion tokens and targets 100% of e-commerce tokenized; Mastercard says three in five of its European e-commerce transactions already run on tokens and aims for all of them by 2030. Fees now reward tokenized traffic and penalize stored PANs. For PSPs, PayFacs and platforms, tokens change provisioning, routing, retries, reconciliation and the invoice.
What is a network token, and how is it different from a PSP token?
EMVCo’s tokenization framework replaces the PAN with a unique alternative value, an EMV Payment Token, constrained to specific devices, merchants or use cases through token domain restriction controls. Three roles define the system: the token service provider (the scheme, or an issuer-appointed provider) that issues and maps tokens, the token requestor (a merchant, PSP, wallet or platform) that asks for them with a registered Token Requestor ID, and the issuer that approves each provisioning. EMVCo keeps the registry of token service providers and BIN controllers.
A PSP or gateway token is different: it is a reference in one provider’s vault that still maps to the stored PAN. It takes the merchant out of PCI scope but does nothing for the issuer, which still sees a PAN. A network token is known to the issuer, carries a cryptogram, and is updated at the source. The two coexist: most PSPs store a network token behind their own vault token.
How do network tokens work?
- Provisioning. At first payment or when a card is saved, the token requestor sends the PAN to the scheme’s token service. The issuer checks the request, sometimes with an identity step, and approves. The scheme returns a token in a dedicated token BIN range, plus an expiry.
- Cryptogram. For each transaction, the token requestor obtains a cryptogram (Visa calls it the Token Authentication Verification Value, TAVV) that proves the token is used in its intended domain. The authorization message carries token, expiry and cryptogram.
- Detokenization. The scheme maps the token back to the PAN before forwarding to the issuer, and maps the response back. The merchant, PSP and acquirer never need the PAN again.
- Lifecycle. When the card is lost, expired or reissued, the issuer updates the token mapping. The merchant’s stored credential keeps working, without an account updater call. Tokens can also be suspended or deleted, per merchant.
- Fallback. If the token service is unavailable or the issuer declines the token, the requestor can retry with the PAN where it still holds one, a case for payment fallback rules.
Wallet payments such as Apple Pay and Google Pay are the oldest use of the same mechanism, with the token bound to a device; we cover them in Xpay. Card-on-file e-commerce tokens bind the token to a merchant instead.
Network tokens in numbers (2026)
- Scale: Visa reported over 16 billion Visa tokens, up from 10 billion in May 2024, in its fiscal Q4 2025 call, with a stated goal of 100% of e-commerce transactions tokenized.
- Europe: Mastercard says three in five Mastercard e-commerce transactions in Europe are tokenised (June 2026), on the road to 100% by 2030.
- Approval uplift: Mastercard cites Checkout.com merchants seeing a 10.3 ppt increase in approval rates with network tokens versus cards (first attempts, financial declines excluded, FY2025 data), and a 7.2% increase in gross sales.
- Fraud: Visa states tokenization can reduce the rate of fraud by up to 60%, and credits tokens with $650 million of fraud avoided in a year and a six-basis-point global approval gain.
- Mandate fee: in Europe, Visa charges an Acquirer SCF Integrity Fee of 0.075% on stored-credential transactions processed without a network token or EMV 3-D Secure since 1 October 2025.
- Token pricing: from 1 April 2026, Visa’s EU acquirer token fee becomes the E-Commerce Token Facilitation Fee, at 5 or 8 basis points per authorization depending on the merchant group, up from a flat EUR 0.02.
What did Visa and Mastercard change in 2025 and 2026?
Two movements run in parallel: mandates on stored credentials, and a repricing of token services.
Mandates
Under Visa’s Secure Credential Framework, acquirers in Europe must ensure merchants can tokenize stored credentials, and the integrity fee above applies to credential-on-file traffic that is neither tokenized nor authenticated, with card payouts and MOTO exempt. In the UAE, Visa requires stored credential transactions to be processed with network tokens from April 18, 2026, with a 0.05% PAN Integrity Fee from 17 October 2026. Our guide to payment methods in the Gulf Cooperation Council gives the local context. In the US, Visa’s Digital Commerce Authentication Program, effective 18 April 2026, pays a 5 basis-point incentive for token-only transactions and 10 for tokenized transactions with enhanced data, against a 5 basis-point program fee. Mastercard Europe’s 2030 target, no manual card entry at checkout, combines tokens with Click to Pay and payment passkeys.
Fees
Token services used to be billed as separate small items (TAVV cryptograms, account updater, lifecycle management). From April 2026 the schemes bundle them: Visa’s US Digital Commerce Services Fee adds four services, including TAVV, and rises to 1.5 basis points domestic and 3.5 cross-border; Mastercard’s US Digital Enablement Fee adds its Token Authentication Framework and moves to a tiered structure from 6 April 2026. CMSPI estimates the token-related part of Visa’s April 2026 US changes at about $122 million a year, plus a new card-present token fee on NFC wallet transactions. The net effect: tokens are cheaper than untokenized stored credentials, but no longer free. How those lines appear on an IC++ invoice is explained in interchange fees.
Network tokens: what changes for PSPs, PayFacs and platforms
Who is the token requestor?
The first decision. If the PSP or acquirer is the token requestor, provisioning is simple but the tokens belong to that integration, and leaving means re-provisioning every stored card. If the platform holds its own Token Requestor ID, its tokens follow it across acquirers, and routing between acquirers becomes possible with the same credential. Migration is not as hard as it sounds, as why migrating tokens doesn’t have to be complicated argues, but it has to be planned before the first token is issued.
Routing, retries and fallback
A token can be routed to any acquirer that accepts it, which makes routing rules credential-aware: token first, PAN as fallback, issuer by issuer. Token BIN ranges differ from PAN ranges, so BIN lookups, local-scheme detection and debit-credit classification must handle both, a point made in why BIN configuration needs a second look and in the #TheShot episode BINs as decision drivers.
Subscriptions and card-on-file
For recurring billing, the token replaces the account updater for most reissues, and the cryptogram rules differ between the first customer-initiated payment and later merchant-initiated ones. A recurring payment infrastructure has to store the token, its expiry, the scheme transaction ID of the initial payment, and the token status returned by lifecycle events. The Payments Library report Card-on-File Done Right covers the stored-credential mandate side.
Authentication
A token cryptogram is not strong customer authentication. In Europe, 3-D Secure or an exemption still applies to customer-initiated token payments, and Visa’s integrity fee is avoided by either a token or EMV 3DS. Payment authentication: 3D Secure, SCA and delegated authentication explains how the two fit together.
Reconciliation, disputes and reporting
Settlement files and dispute notices may carry the token, the PAN’s last four digits, or both. Matching a chargeback to a transaction stored under a token needs the scheme reference, not the card number. Merchant reports should show the funding PAN’s last four digits and brand, not the token’s, or finance teams will search for cards that do not exist. Token fees should be visible per transaction so that platforms can pass them through correctly.
Compliance scope
A platform that only ever holds network tokens and cryptograms, never PANs, shrinks its PCI DSS scope and its breach exposure, the argument of efficiency meets tokenization. NORBr Network Tokenization provisions Visa and Mastercard tokens for the merchants of a PSP or PayFac and routes them across the acquirers listed in our connectors directory, under the operator’s brand. For PSPs modernizing an older stack around this, the upgrade your legacy platform page sets out the path.
Are network tokens worth it in 2026?
Yes, and in Europe and the UAE the question is closed by the rulebook. Tokens lift approvals, cut fraud and keep stored cards alive through reissues, and the schemes now charge extra for stored PANs. The real decisions are operational: who holds the Token Requestor ID, how routing falls back to PANs, how recurring flows carry cryptograms and scheme references, and how reports show cards that tokens have replaced. Platforms that settle those four points early get the uplift; those that leave tokens to each acquirer get locked in.
Frequently Asked Questions
What is a network token in payments?
A substitute card number issued by Visa (VTS) or Mastercard (MDES) in place of the real PAN, tied to one merchant, wallet or device and used with a one-time cryptogram. The scheme updates it when the card is reissued, so stored credentials keep working and a stolen token is useless elsewhere.
Do network tokens improve approval rates?
Yes. Mastercard cites Checkout.com merchants seeing a 10.3 percentage-point approval increase with network tokens versus cards on first attempts (FY2025), and Visa reports a six-basis-point global gain plus up to 60% lower fraud. Results vary by issuer, region and whether lifecycle updates are enabled.
Are network tokens mandatory?
Increasingly. Since 1 October 2025, Visa charges European acquirers a 0.075% integrity fee on stored-credential transactions without a network token or EMV 3-D Secure, and the UAE requires tokens for stored credentials from 18 April 2026. Mastercard targets 100% e-commerce tokenization in Europe by 2030.
What is the difference between a network token and a PSP token?
A PSP token is a reference to a card stored in one provider’s vault; the issuer still sees the PAN. A network token is issued by the scheme, known to the issuer, carries a cryptogram and is updated when the card changes. Most providers store a network token behind their own vault token.
Can network tokens be moved to another acquirer?
Yes, if the platform or merchant holds its own Token Requestor ID: the token then follows it across acquirers that accept tokens. If the acquirer or PSP is the requestor, leaving means re-provisioning stored cards. Decide who holds the requestor ID before the first token is issued; Scheme Ready covers the scheme-side requirements.
