🔐 Tokenization and card authentication around the world

What a payment token is, and what it is not

A payment token is a surrogate for the card number, or PAN: the token travels in its place while the PAN stays locked in a vault. The governing specification, the EMV Payment Tokenisation Specification – Technical Framework, is published by EMVCo; version 2.4 is dated July 9, 2026. It defines three roles. The Token Service Provider generates and stores the token. The token requestor asks for it, and the token carries the requestor's identity, whether a wallet, a merchant, or an acquirer. The token vault holds the mapping between the token and the PAN. No other party holds that mapping.

What sets a token apart from simple encryption of the card number is the set of usage restrictions attached to it. An EMV token is locked to a specific merchant, device, or channel. Stolen from one merchant, it is useless anywhere else. Each payment also carries a cryptogram generated for that transaction, so replaying a captured token cannot produce a valid transaction. A database stolen from a merchant therefore no longer yields reusable card data.

• Device token (DPAN): provisioned into a wallet when the card is enrolled, as in Apple Pay, Google Wallet, or Samsung Wallet. The token requestor is the wallet.
• Merchant token (card-on-file): one token per card-merchant pair, for subscriptions and one-click checkout. Mastercard markets it as Secure Card on File.
• Remote commerce token: used by Click to Pay, the networks' implementation of the EMVCo Secure Remote Commerce specification, live since 2019.
• Acquirer token: requested by the acquirer for its own use, often invisible to the merchant, and not portable when the merchant leaves.

VTS, MDES, and the rest: who runs the vaults

A network token service is the infrastructure a card network uses to generate tokens for its cards, store them, and manage their life cycle. Visa Token Service and the Mastercard Digital Enablement Service, better known as MDES, both launched in 2014, the year Apple Pay debuted. At the time, they served one narrow use case: provisioning a card into a phone. Their scope has since broadened, and the same vaults now support subscriptions, one-click checkout, virtual cards, and agentic commerce. EMVCo maintains the related registries, with two separate registration programs for Token Service Providers and BIN Controllers.

In June 2024, Mastercard set a public goal of 100% tokenized e-commerce in Europe by 2030, with manual card number entry phased out by then. Two years later, the network reports three transactions in five: real progress, but still well short of the target. Click to Pay enrollments in Europe more than doubled year over year, and more than 70% of the service's transactions come from shoppers who were already enrolled. That last figure shows the service working as designed: its value shows up on purchases after enrollment rather than on the first one.

How tokens affect domestic schemes

A co-badged card carries two payment brands, and routing is the choice of which network processes the transaction. When that card is enrolled in a mobile wallet, it is tokenized on only one of the two networks. That choice is locked in at enrollment. It then applies to every wallet payment, regardless of how the terminal or checkout page is configured. A merchant that has set up domestic routing will therefore see part of its volume processed on the international brand, without changing any of its own settings. Nothing flags the shift. It only shows up in the brand mix of the acquirer's reports, month by month, once wallet volume is isolated.

Regulators have responded to this routing shift in different ways. Australia chose regulation. Least-cost routing, mandated by the payments regulator, was extended to mobile wallets and then to Click to Pay online, with rollout starting in early 2026. There, the acquirer chooses the payment application, not the cardholder. In Europe, Article 8 of the Interchange Fee Regulation gives that choice to the cardholder. The same technical object thus falls under two opposite principles depending on where it is used.

India: the only market where tokenization is mandatory

India is the only market where card tokenization is a regulatory mandate rather than a business decision. The Reserve Bank of India has barred merchants and payment aggregators from storing the card number, CVV, and expiration date. Since October 1, 2022, only the issuer and the network hold those three data elements; the merchant handles only the token. Guest checkout allows limited retention: up to four days after the transaction, or until the settlement date if that comes sooner.

These figures show a market of a billion cards switching over in three years, because a regulator set a date and did not keep pushing it back. No voluntary commitment by a card network has ever produced such a fast conversion. The price of India's approach is a one-of-a-kind technical architecture that cannot be replicated elsewhere and that adds to PCI DSS requirements rather than replacing them.

EMV 3-D Secure 2: the protocol, its versions, and its players

EMV 3-D Secure is the cardholder authentication protocol for card-not-present sales, specified by EMVCo and branded by each network. It answers the question tokenization leaves open: a token authenticates the payment instrument, not the person using it. The second generation changed its nature. The first version asked for a password on a redirect page, worked poorly in mobile flows, and drove high abandonment. Version 2 carries far richer context, covering the device, account history, address, and cart. In most cases, the issuer decides on that data alone, without involving the cardholder.

The frictionless rate depends on how many data fields the authentication request carries, and how good they are. A 3DS Server that sends only the minimum leaves the issuer without context, so the issuer challenges more often. Adding the shipping address, customer account age, purchase history, and device data raises the share of authentications approved without interaction. The networks publish data quality requirements and charge for falling short. When a merchant sees an unusual challenge rate, the first thing to examine is the content of its own messages, before blaming issuer decisions.

Europe's strong customer authentication is managed through its exemptions

Strong customer authentication (SCA) requires verifying the payer's identity with at least two independent authentication elements. In the European Economic Area, it applies to electronic transactions under rules set out in a single text, Delegated Regulation (EU) 2018/389, in force since September 14, 2019. The regulation states the requirement in one sentence. It then sets out eight exemptions, listed in Articles 11 through 18. Designing a European checkout is therefore a matter of using those exemptions: the conditions under which a transaction can go through without authenticating the payer.

The transaction risk analysis exemption differs from the other seven: its cap varies by provider. The cap depends on the fraud rate of the provider claiming the exemption, calculated on its own portfolio and monitored continuously. An acquirer whose fraud rate worsens drops a tier and can exempt only smaller amounts. The exemption then stops covering typical order values. A PSP's fraud rate therefore sets the maximum amount it can exempt, which makes it a useful point of comparison between providers before signing a contract.

SCA covers 40% of electronically initiated card payments in the EEA, by number of transactions, so most transactions go through without it. The contactless exemption at the point of sale accounts for 79% of unauthenticated volume, as contactless has become the default way to pay in stores. Among remote transactions without SCA, transaction risk analysis accounts for 29% and merchant-initiated transactions for 22%. A quarter of remote transactions are reported as out of PSD2's scope, a share regulators consider too high given their own clarifications.

Outside Europe: mandate, incentive, or nothing at all

Outside the European Economic Area, authentication regimes range from regulatory mandates to no rules at all. The US imposes no strong customer authentication. There is no equivalent of the EU directive, no exemption to document, and no reference fraud rate to meet. 3-D Secure is a business decision there, made transaction by transaction, weighing fraud risk against the risk of abandonment at the challenge. The local question is when turning it on is justified. The US regulatory constraint lies elsewhere, in debit routing, where Regulation II requires two unaffiliated networks. That requirement was explicitly extended to card-not-present transactions in July 2023.

Japan enforces an authentication mandate that comes from industry rules rather than financial law. The card security guidelines published by the Ministry of Economy, Trade and Industry set the direction, and the issuers' trade association carried it forward: every merchant website had to deploy EMV 3-D Secure by the end of March 2025. The decision was driven by the rise in Japanese card fraud, which hit a record 55.5 billion yen in 2024, more than double the 2020 level. The mandate takes effect through the acceptance agreement between the merchant and its acquirer.

Several regulators in Asia and the Gulf are stripping SMS one-time passcodes of their status as a standalone second factor. These codes can be intercepted, hijacked through SIM swaps, and extracted from cardholders through social engineering. Malaysia's regulator dropped them on those grounds in late 2025, and India's regulator explicitly opens the door to device-bound passkeys and biometrics. Mastercard, for its part, is rolling out payment passkeys in Europe. These decisions converge on a single model, in which authentication is bound to the cardholder's device and secrets no longer travel over an open channel.

Network tokens and authorization rates: what you gain, what breaks

Card networks promote tokenization on two grounds: less fraud and higher authorization rates. The figures they publish to support this are internal measurements, not audited by a third party, and based on portfolios they select. They all point the same way. The underlying mechanism, however, can be verified independently. An issuer that receives an authorization with a token also gets the context in which that token was provisioned. With more data to assess risk, it declines fewer transactions.

A second effect, easier for merchants to verify than the networks' published figures, is that the payment credential survives card reissuance. A merchant token stays valid when the physical card is reissued, because the network updates the mapping in the vault with no action from the cardholder or the merchant. For subscriptions, this eliminates an entire category of renewal failures. “Card expired” disappears from the retry queue. Recurring revenue is preserved, and the gain shows up from the first billing cycle.

• Check who holds the token requestor ID. If the PSP owns it, the tokens do not follow the merchant when it switches providers, and the stored card base has to be rebuilt customer by customer.
• Require the Payment Account Reference in data feeds and reports: without it, two tokens for the same cardholder show up as two separate customers.
• Track token and PAN metrics separately when monitoring approvals: blending the two populations hides exactly the effect you are trying to measure.
• Check how recurring transactions are linked: the first, customer-initiated transaction and the subsequent merchant-initiated ones carry different indicators, and a linking error causes declines that the token does not explain.
• Audit tokenization fees line by line on the acquirer statement, including provisioning and life-cycle fees.
• Test refunds on tokens: the refund flow must trace the original transaction from the token, even after the underlying card has been reissued.

The problems tokenization creates involve data reconciliation and token portability. The same cardholder appears under several identifiers depending on the channel, and matching based on the last four digits of the PAN breaks. Fraud tools trained on card numbers lose their most predictive variable. Promotion abuse controls, in particular, must be rebuilt around the Payment Account Reference. These projects usually start after go-live, once the data no longer reconciles.