Tokenization – The Secret Sauce in Apple Pay

In Host Card Emulation, Insights, Mobile Solutions, Tokenization by Neil Livingston

With new NFC payment technologies like Host Card Emulation and now Apple Pay, many ask us: “What is tokenization?”. This post might help explain.

by Neil Livingston
Director of Mobile Products

Tokenization describes a mechanism in which a 16-digit card number, found on the front of a plastic payment card (the plastic card “PAN”), is replaced by an alternative number (a “token” PAN) for use within a particular consumer device (for example, a mobile phone) to support proximity and remote (m/eCommerce) payments. The plastic card PAN and token PAN are linked by a token mapping service which can relate one to the other. When a token PAN is used to make a payment from an enrolled consumer device, the token mapping service can lookup and recover the plastic card PAN to request payment authorisation from the card issuing institution.The great thing about using token PANs is that they provide added security and a much better user experience over the life of the payments service. For example:

  • Using a token PAN on a consumer device means that the actual plastic card PAN is never used or shared by the consumer during the payment transaction – either at the retail POS or with the online merchant.  In fact, the plastic card PAN is never stored in the consumer device. This means it is possible to switch on and off token PANs on different consumer devices without impacting the plastic card. If a consumer device (for example, a mobile phone) is stolen or the token PAN details have somehow been compromised, then the consumer device / token PAN can be deactivated without impacting/deactivating the plastic card. Indeed, the same plastic card can be mobilised across multiple consumer devices at the same time, each having a different token PAN, all mapping to the same plastic card PAN.
  • Each token PAN can be tied to a single enrolled consumer device and, for added security, the permitted usage of any token PAN can be limited, for example, for use only via the specified consumer device, only over a specific payment channel (NFC, e/mCommerce, etc.), only within certain merchants/locations, or up to specific spend thresholds, etc. These constraints can be checked and validated during the payment transaction to mitigate against fraudulent use.

Carta offers a managed tokenization service to Issuers, in line with the models described in the EMVCo Tokenization framework, and which implements payment-scheme specific specifications and rules. This service is agnostic to the type of deployment model, and supports cloud-based payments models (like MCBP, VCBP), using HCE, and hardware Secure Element-based deployment models (using SIM-based and embedded Secure Elements).