Payment Tokenization
How real card numbers (FPAN) are replaced by tokens (DPAN) for digital wallets, card-on-file, and IoT payments. Covers the full lifecycle, cryptogram generation, and the Visa VTS vs. Mastercard MDES service comparison.
Token Lifecycle
A token moves through distinct phases from initial provisioning through its eventual deletion. Each phase has defined triggers, verification requirements, and state transitions managed by the Token Service Provider.
Animated flow — provisioning & tokenized payment
Adding a card to a wallet (Apple Pay / Google Pay). The real PAN (FPAN) is exchanged for a device token (DPAN) after the issuer verifies the cardholder (ID&V).
Add Card
User adds a card to the wallet on their device.
The device captures the FPAN (typed or from a saved card) and passes it to the token requestor (the wallet) to begin provisioning.
Provisioning Request
The Token Requestor (wallet app, merchant platform) submits the FPAN and its Token Requestor ID (TRID) to the Token Service Provider. The TSP validates the card is eligible for tokenization and forwards the request to the issuer for approval. The issuer sets Token Assurance Level (TAL) requirements for identity verification.
Push Provisioning
Issuer-initiated. Card details pushed from banking app to wallet. Requires deep integration between bank and wallet provider. Higher assurance, no manual entry.
Pull Provisioning
Consumer photographs their card or types it into the wallet. TSP validates via identity check (OTP, banking app confirmation). Most common method.
Identity Check & Token Assurance Level
The issuer or TSP verifies the cardholder's identity before activating the token. The verification method determines the Token Assurance Level (TAL).
| TAL Range | Verification Method |
|---|---|
00 | No identity verification performed |
01-09 | Basic verification (address check, data match) |
10-19 | OTP via SMS/email, or issuer app confirmation |
20-29 | Biometric verification (fingerprint, face) |
30+ | Hardware-bound verification (SE-backed biometric, FIDO2) |
Active
The DPAN is ready for use. Each transaction generates a fresh cryptogram (TAVV for Visa or DSRP for Mastercard) derived from the device's Limited-Use Key and the transaction context. The cryptogram is unique per transaction, preventing replay.
Suspend
Token is temporarily blocked. No transactions can be authorized. Triggers include: device reported lost/stolen, fraud flag raised, cardholder request, or issuer risk decision. The token and its keys persist in the TSP system — it can be re-activated.
Resume
Token re-enabled after investigation and cardholder re-verification. Issuer or cardholder initiates via their banking app or customer service. May require fresh identity verification at the appropriate TAL.
Delete (Permanent)
Token permanently removed. Triggers: device factory reset, card replacement by issuer, explicit cardholder request via banking app, 60+ days of inactivity, or wallet app uninstalled. Once deleted, the DPAN cannot be reactivated — a new provisioning request is required.