What is payment tokenisation? Network, gateway and merchant tokens explained

Digital payments have transformed how customers pay. Customers now expect to save a card once and check out in a single click, to set up recurring deposits, and to move through a payment in seconds. Behind every one of those experiences is a card kept safely on file, and as more commerce runs on stored credentials, doing that securely while keeping payments smooth has become a challenge, but a great opportunity for modern payment infrastructure.

Tokenisation is one of the innovations that makes both convenience and security possible at once. It replaces the real card number with a token that is useless to anyone who intercepts it, so you can offer saved cards, one-click deposits and recurring billing without ever holding the sensitive data. In this article, we’ll explain what payment tokenisation is, how it works, and the key differences between the token types network, gateway and merchant tokens, so you can assess which approach best fits your business needs. 

What is payment tokenisation?

Payment tokenisation is the process of replacing a card’s real number with a substitute value, known as a token. The genuine card details are stored securely in a vault, while your systems store and transact using the token instead. This reduces your exposure to fraud, minimises the scope of your PCI compliance, and enables features such as saved cards, one-click checkout and recurring billing without you ever having to store sensitive card data yourself. 

This matters because card data is both valuable and vulnerable. As online spending continues to grow, and more businesses store card details for recurring billing and one-click checkout, the number of places where card data can be exposed has increased, along with card-not-present fraud. Ecommerce fraud losses are forecast to rise from $44 billion in 2024 to more than $107 billion by 2029, according to Juniper Research. Tokenisation is the payments industry’s answer. Tokenisation preserves the convenience of stored card details without storing the card itself, and has therefore become a fundamental expectation under PCI DSS,  rather than an optional extra.  

However, not all tokens are created equal. The type of token you use  determines how portable your customer credentials are, whether they continue working when a card is reissued, and how much authorisation uplift you can achieve.  

How tokenisation works, step by step

Tokenisation happens behind the scenes during a payment, so your customer never sees it. The process is straightforward. 

1. At checkout, your customer enters their card number, known as the Primary Account Number (PAN).
2. The PAN is securely sent to your payment provider or payment orchestration platform, rather than being stored by you.
3. The real card data is placed in a secure, PCI-compliant vault, and a token is created to represent it. That token can take one of a few forms:

• A gateway or PSP token, generated by your provider. It works within that provider, and at payment time the vault swaps it back to the real card number to authorise the transaction.
• A network token, requested from the card scheme (Visa or Mastercard). Rather than being swapped back to the card number, it is used in the authorisation itself with a single-use cryptogram that the scheme and issuer resolve, and it updates automatically when a card is reissued.
• A merchant token, generated for you but owned by you, so the same token can be reused across your channels and providers instead of being tied to one.

4. Whichever form it takes, the token is returned to you and stored in your systems in place of the card number.
5. When you take a payment, you send the token, and you only ever receive an approval or a decline. The real card data never sits in your environment.

The token itself cannot be reverse-engineered to reveal the original card number. On its own it is worthless, which is exactly the point. Think of it like a cloakroom ticket, it represents the coat, but it has no value to anyone who finds it on the floor. 

Turning a token back into the original card number is called detokenisation, and only the system that created the token can perform it. In most tokenisation models, the mapping between the token and the original card data is stored in a secure vault.  Some “vaultless” approaches instead generate  tokens algorithmically, removing the need for a central vault altogether. Either way, your systems never need to store or process sensitive card data.

The main types of payment tokens

There are three main types of payment tokens that most businesses should understand, plus two others worth knowing. 

Gateway (or PSP) tokens are created and managed by a single payment provider. They work well while you remain within that provider’s ecosystem, but most of the time cannot be transferred to another provider, and they typically do not update automatically when a card is reissued. This is one of the main reasons businesses experience provider lock-in.

Network tokens are issued directly by the card schemes, such as Visa and Mastercard, and replace the PAN  throughout the payment journey, from your checkout to the issuing bank. As the card scheme and issuer keep them up-to-date, network tokens continue working when a customer’s card expires or is replaced. Each transaction also includes a unique, single-use cryptogram, giving issuers greater confidence to approve the payment. 

Merchant tokens are generated for a specific business and controlled by that business rather than a payment provider. As you own them, they can be used across your sales channels and linked to multiple acquirers, giving you a level of portability that gateway tokens cannot offer. 

While these are the three main token types, there are two additional ones used within the payments ecosystem. Acquirer tokens are managed by the acquirer that processes your transactions. Issuer (or device) tokens power digital wallets such as Apple Pay and Google Pay, and are stored on your customer’s device, where they are unlocked using biometric authentication or a device passcode. 

With the different token types explained, here’s  how the three main options compare at a glance. 

Network tokens versus gateway tokens: the difference that moves the numbers

With a gateway token, the issuing bank never knows the transaction was tokenised because the real PAN is restored before the authorisation request reaches them. With a network token, the issuer receives the request in its tokenised form, complete with a unique, single-use cryptogram, allowing it to assess the transaction with greater confidence and potentially score the risk more favourably. 

This is what drives the performance benefits. According to Visa, network tokens can  increase card-not-present authorisation rates by 4.6% on average and reduce fraud by  around 28% compared with transactions using the raw card number.

 Mastercard has said it is working towards 100% of online transactions being tokenised by 2030. As adoption grows, businesses that continue relying solely on gateway tokens risk missing out on higher approval rates, lower fraud and the operational benefits that network tokens provide. Over time, that could mean lower conversion, more failed payments and higher processing costs compared with businesses that embrace network tokenisation.

Tokenisation is not the same as encryption

Tokenisation and encryption are often confused, but they serve different purposes. Encryption converts data into an unreadable format that can only be decrypted using the correct key. Tokenisation, on the other hand, replaces sensitive data entirely with a token that has no mathematical relationship to the original and cannot be reverse-engineered.  

While encryption protects sensitive data as it moves between systems, tokenisation removes that sensitive data from your systems altogether by replacing it with a token. In practice, the most secure payment environments use both technologies together, with encryption protecting data in transit and tokenisation reducing the amount of sensitive data you need to store and process.

Why tokenisation matters for your business

Tokenisation delivers several practical benefits for your business:

• It reduces your PCI scope: When sensitive card data never touches your systems, far fewer of them fall within the scope of PCI DSS. That means simpler compliance processes, less administrative overhead and potentially lower audit costs.
• It  reduces fraud risk: A stolen token is worthless outside the secure vault that created it, so even if your systems are compromised, attackers cannot use the token to make fraudulent transactions.
• It  improves payment acceptance: Tokenised transactions, particularly those using network tokens,provide issuers with stronger security signals and continue working automatically when cards  are reissued or replaced. The result is fewer legitimate payments being declined. 
• It creates a better customer experience: Features such as saved cards, one-click checkout and recurring billing all rely on storing payment credentials securely. Tokenisation makes this possible without you having to store sensitive card details yourself. 

The limits worth knowing

While tokenisation offers significant benefits, there are a few limitations to be aware of. Network tokens are not yet universally supported, with availability varying by payment provider, card issuer and region. Automatic lifecycle updates also depend on issuer and regional support. 

A provider-neutral, portable token model gives you greater flexibility, but it typically works best alongside payment orchestration and requires additional implementation effort. The right  approach depends on where your business is heading, rather than there being a single “best” token type. If you expect to stay with one payment provider long term, a gateway token may be  sufficient. However, if you plan to route across multiple providers, expand into new markets or switch PSPs without asking customers to re-enter their payment details, portability should be a key consideration.

What this looks like in practice

Imagine you’re an operator running recurring card deposits for returning players. Over a busy weekend, a large number of customer cards expire and are reissued. With gateway tokens tied to a single payment provider, those stored credentials can become outdated, deposits start failing and support tickets increase at exactly the wrong time. With network tokens, the same credentials are automatically updated by the issuer, so deposits continue without interruption and the player never notices. 

Add merchant-owned tokens and payment orchestration, and you can also route transactions to a second acquirer during  peak demand as an added layer or resilience, without asking customers to re-enter their card details. While this example focuses on gaming, the same principle applies to any business that relies on stored payment credentials. When payment continuity matters, your token strategy plays a bigger role than you might think.

Tokenisation with Paysecure

At Paysecure we offer a centralised, PCI-compliant token vault solution, keeping sensitive data out of your environment while providing a single source of truth for your stored payment credentials. We support Visa and Mastercard network tokens to improve lifecycle management and  reduce declines, and because our token vault is PSP-agnostic, you have the freedom to switch or add providers without disrupting your customers. You can read more on our tokenisation page.

Handled well, tokenisation is more than a compliance  requirement. It’s  a strategic decision that gives you the flexibility to grow, adapt and build a more resilient payment ecosystem. If you’re considering how to structure your tokenisation strategy, we’d be happy to help. Get in touch.