Payments
Network token
A network token is a card-network-issued substitute for a card number that lets a merchant charge a stored credential without holding it, and survives card reissue.
Network tokens raise authorization rates and reduce the maintenance burden of stored credentials, because the token remains valid when the underlying card is renumbered or reissued.
They also bear on platform lock-in. Whether tokens can move between processors is the single fact that determines whether a subscription business can change platforms without asking every active subscriber to re-enter a card — which is where a share of them are lost permanently.
What the networks actually issue
Each network runs a tokenisation service — Visa Token Service, Mastercard Digital Enablement Service, American Express Token Service — and what those services issue is a surrogate account number. It is the same shape as a card number and it moves through the same rails, but it is drawn from a token BIN range and it is not the customer's card.
Three attributes are attached to it, and they are what separate a network token from an ordinary database reference. A token requestor ID identifies the party entitled to use it. Domain restriction controls limit where it may be presented — which channel, which merchant, which kind of transaction. And each authorisation carries a cryptogram, a per-transaction value that proves the request came from the entitled requestor rather than from someone who copied a number out of a log.
That combination is why a leaked network token is a much smaller event than a leaked card number. On its own it authorises nothing, because it cannot be presented outside its domain and cannot produce a valid cryptogram.
The networks also expose a payment account reference, a stable identifier for the underlying card that travels with every token minted from it. It lets a merchant recognise that two tokens are the same customer's card — for deduplication, for fraud rules, for spotting the same credential across a web checkout and a wallet — without ever seeing the card number.
What happens when the card is reissued
The token is a reference to a mapping the network maintains, not a copy of the card. When the issuer reissues the card with a new number or a new expiry date, the network updates its side of the mapping. The token you stored does not change, and neither does anything in your database.
This is a different mechanism from an account updater, and the difference is worth being precise about. An updater changes the value you hold: it returns a new number, you write it into your vault, and you must have run the query in time for the write to land before the charge. A network token changes nothing you hold, because the value you hold was never the card in the first place.
The practical consequence is that the class of failure caused by stale credentials largely disappears rather than being managed. There is no batch to schedule, no response file to process and no window in which your copy is out of date. For a subscription book where the average credential is years old, that class of failure is not a rounding error.
Why authorisation rates move
The lift comes from three separate mechanisms, and separating them matters because they do not apply equally to every merchant.
The first is arithmetic: charges that would have failed on an expired or renumbered card now succeed, so the failures leave the denominator. The second is the cryptogram, which gives the issuer's risk model a strong authenticity signal that a bare card number cannot carry — a tokenised request is verifiably from the merchant entitled to make it, which is precisely the distinction issuer models struggle to draw between a legitimate stored credential and a card-testing script. The third is data completeness: tokenised transactions carry richer identifiers through the network, and issuers can therefore apply a more informed decision than a conservative default.
It follows that the size of the improvement depends on what your book looks like. A merchant charging fresh, in-market cards a single time each has little to gain, because few of its credentials are stale and its risk profile is already legible. A subscription business billing three-year-old credentials across multiple markets is the case network tokens were built for. Anyone quoting a single uplift percentage as though it were a property of the technology is describing their own book, not yours.
Network token versus processor vault token
Both are tokens and both keep card numbers out of your systems, which is where the similarity ends. A processor vault token is a reference in one company's database. A network token is an instrument the card network issued and continues to maintain.
The distinction that decides platform migrations is who the token requestor is. In most standard integrations the processor or gateway is the token requestor of record, which means the tokens are provisioned to them rather than to you. The networks do support arrangements where a merchant is its own token requestor, and they support portability requests between requestors, but neither is automatic and neither happens without the cooperation of a party whose commercial interest points the other way. The time to establish which arrangement you are on is before you have a subscriber base, not during a migration.
| Property | Network token | Processor vault token |
|---|---|---|
| Issued by | The card network | The processor or gateway |
| Format | A surrogate account number on a token BIN | An opaque identifier in a private database |
| Survives card reissue | Yes — the network maintains the mapping | No — the vault holds a value that goes stale |
| Per-transaction cryptogram | Yes | No |
| Recognised across tokens | Yes, via the payment account reference | No, unless the vault owner exposes it |
| Moves to another processor | Possible, depending on the token requestor and the agreement | No — the value is meaningless outside that vault |
| If you leave the provider | A portability request is at least a route that exists | A vault-to-vault transfer both parties must agree to |
| Effect on stale-credential failures | Largely removes them | Requires an account updater on top |
Frequently asked questions
- What is a network token?
- A network token is a substitute account number issued by a card network — Visa, Mastercard or American Express — to stand in for a customer's real card number. It is restricted to a defined merchant and channel, is presented with a per-transaction cryptogram, and stays valid when the underlying card is reissued, because the network maintains the mapping to the real card.
- What are network tokens used for?
- They are used wherever a merchant needs to charge a stored card repeatedly: subscriptions, one-click checkout, saved cards in an account, and wallet payments. The merchant stores the token instead of the card number, which keeps card data out of its systems, keeps the credential from going stale when the card is reissued, and gives the issuer a stronger authenticity signal at authorisation.
- Do network tokens improve authorization rates?
- They improve them through three mechanisms: failures from expired and reissued cards stop occurring, the per-transaction cryptogram gives issuer risk models evidence the request is legitimate, and the richer data carried through the network supports a better-informed decision. The size of the gain depends on the merchant's book — an old subscription file benefits far more than fresh one-off card entry.
- What is the difference between a network token and a processor token?
- A processor token is a reference in one payment provider's private database; it means nothing to anyone else and it goes stale when the card is reissued. A network token is issued by the card network itself, carries a cryptogram, and stays valid across reissues because the network updates the mapping. Only the network token has any route to another processor.
- Can network tokens be moved to another payment processor?
- Sometimes, and it depends on who holds the token requestor ID. If your processor is the token requestor, the tokens are provisioned to them and moving requires their cooperation through a network portability process. If you are your own token requestor, the position is far stronger. Establish which arrangement you are on before you have a large stored-credential base.
- Do network tokens update automatically when a card is reissued?
- Yes. The token you store is a reference, not a copy of the card, so when the issuer reissues with a new number or expiry the network updates its mapping and the token continues to work. Nothing in the merchant's database changes and no batch file has to be processed, which is the main operational difference from an account updater.
In depth: How to migrate an ecommerce platform