What is a network token?

A network token (DPAN) is a substitute card number issued by the scheme's token service that replaces the real PAN (FPAN) in transactions — the mechanism behind Apple Pay, Google Pay, and secure card-on-file.

What is the difference between a DPAN and an FPAN?

The FPAN is the funding PAN printed on the card; the DPAN is the device/merchant-specific token that represents it. The token service maps DPAN back to FPAN during authorization.

What are VTS and MDES?

Visa Token Service and Mastercard Digital Enablement Service are the schemes' tokenization platforms: they issue tokens, manage their lifecycle, and validate token cryptograms.

Why do tokenized payments use cryptograms?

A per-transaction cryptogram (e.g. TAVV) proves the token was used by the legitimate holder in its bound domain, so a stolen token is useless outside it.

← Payment Reference GuidesSecurity Reference

Payment Tokenization

How real card numbers (FPAN) are replaced by tokens (DPAN) for digital wallets, card-on-file, and IoT payments. Covers the full lifecycle, cryptogram generation, and the Visa VTS vs. Mastercard MDES service comparison.

FPAN vs. DPAN

Payment tokenization replaces a cardholder's real card number (FPAN — Funding PAN) with a surrogate value (DPAN — Device/Digital PAN) that is useless outside a restricted domain. Defined by the EMVCo Payment Tokenization Specification v2.0+, the token passes the Luhn check and appears to be a valid PAN to legacy systems while being restricted to a specific device, merchant, or use case.

FPAN

Funding PAN

The real card number issued by the bank
16-19 digits, Luhn-valid
Linked to cardholder's account
If compromised, entire card must be reissued
Stored in issuer's card management system
Never transmitted by tokenized wallets

→

DPAN

Device / Digital PAN

Token issued by Token Service Provider (TSP)
Same 16-digit format, Luhn-valid
Restricted to specific device / merchant / channel
If compromised, only that token is affected
Stored in device Secure Element or cloud
Used in actual payment transactions

Key Benefits

Breach Isolation

A merchant data breach exposes only DPANs, not real card numbers. No reissuance required for unaffected merchants.

Domain Restriction

Tokens are valid only within their provisioned domain. A mobile wallet token cannot be used for card-on-file at a different merchant.

Card on File

Merchants store DPAN instead of FPAN. Recurring charges continue uninterrupted even when the physical card is replaced.

Cryptographic Proof

Each transaction generates a unique cryptogram (TAVV/DSRP) proving device possession. Replay attacks are prevented.