Tokenization is the process where sensitive data or value is replaced with a unique identifier or an object to represent this data or value. In this blog, we talk about how tokenization is used in the credit card industry.
Tokenization protects sensitive data by locking it away behind a unique identifier that only a trusted entity can access. It is seeing a surge in popularity, especially due to the emergence of mobile payments and apps like Apple pay and Google pay.
What is a token?
A token is a piece of data that stands for another piece of information that is usually more valuable and needs to be secured. Tokens are worthless by themselves but are used to represent valuable or sensitive data.
For example, a poker chip is a token that represents value. Players use chips as placeholders, instead of throwing cash on the table. After the game, chips must be exchanged, since they have no value on their own and can’t be used as money. These chips are worthless outside of the trusted entity, in this case, the casino.
This is exactly how tokenization works. Value or data is replaced by a token. Sensitive data can be anything, from credit card data to medical info. Anything that requires protection and security. Tokenization means that sensitive data is taken out of transactions and replaced by a meaningless and insensitive token.
How does it work for credit cards?
Sensitive data is sent via an API call or batch file to a tokenization provider. The provider then substitutes the data with tokens that represent the data. The tokens are used to recall elements of the original data and are sent to an organization’s closed-loop system. The original data is saved in a protected token vault.
Tokenized data is indecipherable and irreversible. A token cannot be returned to the original structure, since there is no mathematical connection between the token and the original data.
Example of tokenization
Let’s say we have a customer’s credit card. The card number is replaced with a string of random digits like 71561cbb-ccf6-4fb4-8c16-b3e84f59fa62 by the payment processor.
The merchant can save the token ID but does not possess the actual data. This means that the token ID is linked to the user’s sensitive information like name and credit card number in a closed-loop system. When the user wants to initiate the payment, the token is transferred to the payment processor where de-tokenization of that token happens and the payment is approved. This makes reusing the credit card safer and also that token ID can only be used once with the same underlying credit card.
The only party that can read the token is the payment processor. To anyone else, tokens are just meaningless strings. Another powerful mechanism of tokenization is that unique tokens are created with every merchant which makes fraud attempts more difficult.
Advantages and drawbacks
The advantages are apparent for users, as their data is less likely to be breached and used to make unauthorized payments. Tokenization, therefore, improves privacy and security for the end-user. For the most part, this process is invisible to the end-user, so no additional action is needed from them.
The drawbacks mostly appear on the merchant side as collecting user demographic data is instrumental in targeting potential customers. Tokenization can hinder this effort by masking user data to the point that user location and credit card provider is hidden. Merchants can still require users to create profiles on their stores to come around this.
Conclusion
Even though there is no technology that can guarantee the prevention of a data breach, tokenization can block and limit some breaches. Check out what you can do to help secure your computer and your information in our article about cybersecurity.
Tokenization denominates different processes in the credit card industry and in blockchain. Check out our next blog to learn more about tokenization on blockchain.
