Skip to main content

Saving Cards Without Storing the Number (Tokenization)

TL;DR
  • Tokenization replaces the real card number (PAN) with a non-sensitive token, reducing PCI scope and preventing stored card data from being useful to attackers
  • Network tokens (issued by Visa/Mastercard) update automatically when a card is replaced or reissued, improving recurring billing auth rates by 2-5% vs. stored PANs
  • Gateway tokens (issued by your processor) aren't portable between processors. Network tokens can be migrated using token service provider APIs
  • If you're on Stripe or Square, you're already tokenizing - but you may not be using network tokens yet; ask your processor if they support network tokenization

Tokenization replaces a customer's real card number with a meaningless stand-in code that only your processor or the card network can turn back into the original. You're already tokenizing and nobody told you. Take cards through Stripe or Square using their hosted fields, and your database never holds a real card number. That's gateway tokenization. It shrinks your PCI scope, and it makes a stolen database much less useful. The second kind, network tokens, is worth 2-5% on your auth rate.

So the question isn't whether to tokenize. It's whether you're getting network tokens too, and what happens to your saved cards the day you switch processors.

What is Tokenization?​

Tokenization replaces the card number (PAN - Primary Account Number) with a randomly-generated token:

OriginalTokenized
PAN: 4111 1111 1111 1111Token: tok_1Abc23Def456Ghi7
Sensitive, reusableNon-sensitive, single-use or limited-use

The token maps back to the real card number. That vault belongs to your processor or the card network.

Why Tokenization Matters​

1. PCI Scope Reduction

  • You don't store actual card numbers
  • Reduces PCI DSS compliance requirements
  • Lowers breach liability

2. Security

  • Stolen tokens are useless (can't be used elsewhere)
  • Data breaches expose tokens, not cards
  • Limits damage if your database is compromised

3. Higher Auth Rates (network tokens only)

  • Network tokens have 2-5% higher approval rates
  • Issuers trust network tokens more
  • Fewer false fraud declines

Types of Tokenization​

Gateway/Processor Tokens​

What happens: Your processor (Stripe, Square, etc.) swaps card numbers for tokens

How it works:

  1. Customer enters card on checkout
  2. Card data goes directly to processor (via API or hosted form)
  3. Processor stores card, returns token to you
  4. You store token, not card number
  5. For future charges, you send token to processor

Benefits:

  • Reduces PCI scope
  • Easier compliance (SAQ A vs SAQ D)
  • Your database doesn't have card numbers

Limitations:

  • Tokens only work with that processor
  • Can't port tokens if you switch processors
  • No auth rate improvement

Who uses it: All modern processors (Stripe, Square, Braintree, etc.)

Network Tokens​

What happens: Visa, Mastercard, and Amex swap card numbers for network-specific tokens

How it works:

  1. Customer card → Gateway token → Processor requests network token
  2. Network (Visa/Mastercard) provisions network token
  3. Network token used for authorization
  4. Issuer recognizes network token as more secure
  5. Higher approval rates result

Benefits:

  • 2-5% higher auth rates
  • Automatic card updates when reissued
  • Better fraud scoring by issuers
  • Potential liability shift benefits

Limitations:

  • Requires processor support (not all support it)
  • Additional fees with some processors ($0.01-$0.05/transaction)
  • Migration from gateway tokens requires work

Who supports it:

  • Stripe: Yes (automatic for subscriptions)
  • Shopify Payments: Yes (automatic)
  • Adyen: Yes
  • Square: No (doesn't support network tokens)
  • PayPal: Limited

Gateway Tokens vs Network Tokens​

FeatureGateway TokenNetwork Token
Created byProcessor (Stripe, etc.)Network (Visa, Mastercard)
Formattok_abc123 (processor-specific)4111 11XX XXXX 1111 (looks like card)
PortabilityLocked to processorLocked to card network
Auth rate improvementNone2-5% higher
Card updaterSeparate serviceBuilt-in (auto-updates)
PCI scope reductionYesYes
CostIncluded$0-$0.05/transaction

Best practice: Use both

  • Gateway tokens: For PCI scope reduction
  • Network tokens: For auth rate improvement

Stripe automatically uses network tokens for recurring payments when beneficial.

How Tokenization Improves Auth Rates​

Why Issuers Trust Network Tokens​

Regular card-on-file transaction:

  • Issuer sees: Card number, merchant, amount
  • Issuer thinks: "Is this fraud? Card was stored somewhere."
  • Issuer declines: 10-15% of card-on-file transactions

Network token transaction:

  • Issuer sees: Network token (cryptographically linked to card)
  • Issuer thinks: "This token was provisioned securely. Lower fraud risk."
  • Issuer declines: 5-10% of network token transactions

Result: 2-5% auth rate improvement from token trust signals.

Real-World Data​

ScenarioRegular Card-on-FileNetwork TokenImprovement
Subscription renewal87% approval91% approval+4%
Repeat customer89% approval93% approval+4%
Card updated by issuerDecline (old card invalid)Auto-updated, approvedMajor

At $1M/month recurring revenue:

  • 4% improvement = $40K/month recovered
  • Network token cost: $0-$500/month
  • Net benefit: $39.5K/month

Token Portability (Lock-In Risk)​

Gateway Tokens Are NOT Portable​

If you're on Stripe:

  • All your saved customer cards are Stripe tokens
  • Switch to Braintree? Tokens don't work.
  • You must re-collect card numbers from customers

That's processor lock-in. Switching means re-collecting cards from every customer you have.

Migration options:

  1. Email blast: "Update your card" (10-30% update rate)
  2. Lazy migration: Collect new cards as customers transact (takes 6-12 months)
  3. Forced migration: Require card re-entry (high churn risk)

Network Tokens Are Somewhat Portable​

If your new processor supports network tokens:

  • Request token migration through networks
  • Not all processors support this
  • Complex process, not always successful

Reality: Treat all tokens as non-portable. Switching processors = painful card migration.

Tokenization and PCI Compliance​

SAQ Reduction​

SetupSAQ LevelComplexity
Store card numbersSAQ D (300+ questions)Very complex
Use gateway tokensSAQ A-EP (150 questions)Moderate
Fully outsourcedSAQ A (22 questions)Simple

Tokenization moves you from SAQ D to SAQ A-EP (much easier).

What Tokenization Doesn't Solve​

Tokenization shrinks your scope. It doesn't erase it. You still need:

  • Secure transmission (HTTPS/TLS)
  • Vulnerability scanning
  • Access controls
  • Logging and monitoring

It's not a PCI magic bullet. It's just a much smaller job.

See: PCI DSS Compliance for full requirements.

Implementation by Processor​

Stripe​

Gateway tokens: Automatic

  • Customer cards become pm_ or card_ tokens
  • Stored securely by Stripe
  • You never see full card number

Network tokens: Automatic for subscriptions

  • Stripe requests network tokens when beneficial
  • No action needed
  • Included in standard pricing

Migration: Tokens locked to Stripe

Square​

Gateway tokens: Automatic

  • Customer cards become Square tokens
  • Stored in Square system
  • Card-on-file for recurring

Network tokens: Not supported

  • Square doesn't offer network tokenization
  • No auth rate benefit from network tokens
  • Card updater is separate service

Migration: Tokens locked to Square

Shopify Payments (Stripe-powered)​

Same as Stripe:

  • Gateway tokens automatic
  • Network tokens automatic
  • Full Stripe tokenization features

Adyen​

Both supported:

  • Gateway tokens included
  • Network tokens available
  • Must be enabled explicitly
  • May have additional fees

Test to Run​

Network token ROI calculator (if available on your processor):

Week 1: Check eligibility

  1. Are you on Stripe, Shopify, or Adyen? (Yes = network tokens available)
  2. Do you have recurring billing or card-on-file? (Yes = network tokens beneficial)
  3. What's your current card-on-file auth rate? ____%

Week 2: Estimate impact 4. Current decline rate: % 5. Expected improvement with network tokens: 2-4% 6. Monthly card-on-file volume: $_ 7. Recovered revenue: volume × decline rate × 50% recovery = $_____

Week 3: Implementation 8. Enable network tokens in processor dashboard (Stripe: automatic for subscriptions) 9. Monitor auth rate improvement 10. Track recovered revenue

Success criteria: 2-5% auth rate improvement on card-on-file transactions within 30 days.

Scale Callout​

Under $100K/month:

  • Gateway tokens sufficient (PCI scope reduction)
  • Network tokens nice-to-have but not critical
  • If on Stripe, you get network tokens automatically

$100K-$500K/month:

  • Network tokens start mattering
  • 4% improvement = $4K-$20K/month recovered
  • Worth optimizing

$500K-$1M/month:

  • Network tokens are must-have
  • If your processor doesn't support, consider switching
  • ROI is clear ($10K-$40K/month)

Over $1M/month:

  • Ensure network tokens are enabled
  • Monitor network token adoption rate
  • Optimize for maximum network token usage

Where This Breaks​

  1. Not all processors support network tokens: Square doesn't. Many traditional processors don't. If this matters, choose your processor accordingly.

  2. Token migration is painful: Switching processors means re-collecting cards. Price that in before you switch.

  3. Network tokens can cost extra: no processor checked on 2026-08-02 lists a network tokenization fee on its published pricing page, in either direction. That means "it's free" and "it's a cent a transaction" are both unverified claims. Ask your processor directly. Get the answer in writing. Then run the ROI on the real number.

  4. Card updater vs network tokens confusion: These are different features. Network tokens auto-update as a side benefit, but card updater (CAU) is separate.

  5. PCI scope reduction isn't automatic: You still need proper implementation. Tokenization helps but doesn't eliminate PCI requirements.

Next Steps​

Want to use tokenization?

  1. Check if your processor supports it (Stripe, Shopify, Adyen = yes)
  2. Verify it's enabled (usually automatic)
  3. Ensure you're not storing raw card numbers anywhere

Want network tokens?

  1. Check processor support (Stripe auto-enables for subscriptions)
  2. Calculate potential auth rate improvement
  3. Monitor impact on recurring billing auth rates

Switching processors?

  1. Plan for token migration (customers will need to re-enter cards)
  2. Read Processor Switch Checklist
  3. Budget 3-6 months for full customer migration

See Also​

Last updated on