Network tokenization

Network tokenization is a security process in which a card network, such as Visa or Mastercard, replaces a customer's actual card number (the primary account number, or PAN) with a unique digital token that is tied to a specific card instrument, a specific merchant, or platform. The token can be used to process a payment in place of the real card number, so the sensitive card details never need to be stored or transmitted by the merchant. The token is portable across gateways, which reduces complexity in payment orchestration.

For a subscription business, network tokenization has particular value because a token issued by the card network is generally kept up to date automatically when a customer's card is reissued, renewed, or updated, unlike a static card number stored on file that can become invalid overnight. A subscription platform such as Recurly can store and use network tokens instead of raw card numbers for recurring billing, which reduces the amount of sensitive cardholder data the merchant needs to handle directly. Recurly offers network tokens through Visa and Mastercard.

Why network tokenization matters for subscription businesses

Recurring billing depends on being able to charge a saved payment method reliably over time, and one of the most common causes of failed renewals is a card number that has changed because the card was reissued, upgraded, or replaced after being reported lost or stolen. Because a network token is managed and refreshed by the card network itself, tokenized card details are less likely to go stale between billing cycles than a raw card number stored by the merchant. Approval lift varies by Issuer, but generally Visa and Mastercard boast an average 2-6% increase in success-rates depending on the card brand.

Network tokenization also reduces the security exposure a subscription business carries. Because the merchant stores a token rather than the actual card number, a data breach involving tokenized payment data is far less useful to an attacker, since the token is tied to a specific platform or merchant relationship and cannot be freely reused elsewhere the way a stolen card number could.

How network tokenization works

Network tokenization follows a defined process each time a card is enrolled and subsequently reused:

1. When a customer's card is added to a merchant's payment flow, the request to store that card is routed to the relevant card network's tokenization service.

2. The card network verifies the card and issues a token, a substitute number that maps to the real card but has no independent value if intercepted outside of the specific device, merchant, or channel it was issued for.

3. The merchant or its payment processor stores the token instead of the actual card number, and uses the token to initiate future transactions, including recurring subscription charges.

4. When the transaction is processed, the token is passed to the card network, which maps it back to the real card number behind the scenes to complete authorization with the issuing bank.

5. If the underlying card is reissued, such as after an expiration or a reported loss, the card network can automatically update the token to reflect the new card details, without the merchant needing to request updated card information from the customer.

How to use network tokenization in a billing program

A subscription business considering network tokenization should approach it as part of its broader payment security and dunning strategy:

• Confirm with the payment gateway or processor whether network tokenization is supported, and for which card networks and regions.

• Prioritize tokenizing payment methods for recurring and subscription use cases specifically, since these benefit most from the automatic token refresh behavior.

• Combine network tokenization with a card account updater service and a smart retry strategy for the cases where a token still cannot be refreshed automatically.

• Review PCI compliance scope with the payment processor, since storing tokens instead of raw card numbers can reduce the amount of sensitive data the merchant's systems need to handle directly.

Benefits and examples

Network tokenization offers several concrete benefits for a subscription business:

• Reduces involuntary churn from failed renewals caused by outdated card details, since tokens are refreshed by the card network when the underlying card changes.

• Lowers security risk, since a token has limited or no value if it is intercepted or exposed outside of its intended device or merchant context.

• Can reduce PCI compliance scope for the merchant, since less raw cardholder data needs to be stored or transmitted directly.

• Supports a more consistent customer experience, since customers do not need to be prompted to re-enter card details every time a card is reissued.

As an illustrative example, imagine a subscriber's card is set to expire at the end of the month, and their bank automatically issues a replacement card with a new expiration date and a new card number as part of a routine reissue. If the subscription business relies on network tokenization, the card network can update the associated token behind the scenes, so the next scheduled renewal charge processes successfully using the updated card details, without the merchant needing to ask the customer to re-enter their payment information.

Network tokenization vs gateway tokenization

Network tokenization is issued and maintained by the card network itself, which means it can be automatically refreshed when the underlying card is reissued, and it can potentially be used across multiple gateway relationships that support network token processing. Gateway tokenization is issued by an individual payment gateway rather than the card network, substitutes the card number with a token scoped to that specific merchant, gateway relationship, and may not receive the same automatic network-level updates when the underlying card changes. Both approaches reduce the amount of raw card data a merchant stores, but network tokenization specifically addresses the problem of stale card details on recurring transactions, along with ease of portability.

Frequently asked questions

Is network tokenization the same as encryption? No. Encryption transforms card data using a reversible mathematical process protected by a key. Network tokenization replaces the card number entirely with a substitute value that has no mathematical relationship to the original number and can only be mapped back to the real card by the card network that issued it.

Does network tokenization eliminate the need for a card account updater? Conditionally yes, but not always. Network tokenization often reduces the number of renewal failures caused by outdated card details, but a merchant may still need to monitor card network updates to keep their systems up to date or retry logic to handle cases not covered by tokenization, such as cards issued by networks or issuers that do not support tokenization for a given transaction type. For example, Discover network tokenization offers limited support, so account updater for discover brand cards is still required.

Which card networks support network tokenization? The major global card networks, including Visa and Mastercard, operate their own tokenization services, and support can vary by region, issuer, and transaction type.

Does network tokenization affect the customer experience at checkout? It depends on the network and the specific integration. Tokenization typically happens behind the scenes after a card is added, so the customer's checkout and payment experience typically looks the same whether or not the underlying transaction uses a network token. However, Mastercard offers pre-transaction tokenization to ensure the customer-in-session card is tokenized before sending to the payment gateway.