The Untold Truth About Network Tokens

Visa has reported that network tokenization can improve authorization rates by 4% or more and reduce fraud by 28%, making it an important tool for online businesses. But what about the fine print? 

For example, can you just provision a network token with your payment service provider (or PSP), and voilà—you reap all the benefits of fraud reduction, higher approval rates, and up-to-date card data?!  

In this case, the underlying assumption is that these benefits are automatic—that a network token provisioned by your PSP is the same as any other network token. However, the truth is that PSPs and payment orchestrators have different practices around network tokenization that can impact your ability to fully recognize its benefits. When choosing a provider, there are a few considerations you will want to factor into your decision.

In this post, we’ll walk through the example above in more detail and address other nuances that aren’t always mentioned in the marketing brochure. By reading, you’ll have the whole truth about the options available to implement network tokens.

How Network Tokens Work  

Similar to standard provider or PCI tokenization, network tokenization works by exchanging sensitive cardholder data (i.e., the primary account number or PAN) for a nonsensitive placeholder value called a token. This token offers the same functionality as the original data without the associated risk. However, since network tokens are provisioned in partnership with the networks and issuing banks, the token format is maintained for a greater part of the transaction flow. Fewer points of detokenization mean a more secure transaction. 

This results in significantly less risk of sensitive data exposure. Even if a network token is intercepted, the data is useless to bad actors as there is no way to reverse engineer the token to obtain the original PAN. As an extra layer of security, network tokens also employ single-use cryptograms during the transaction. 

While different networks may have slightly different network token configurations, they all enjoy a type of embedded account updater service to keep the underlying card data up-to-date, hence the increased authorization rates. Network tokens do not generally expire the same way cards do, and the token value seldom changes, if ever. Even if the card data changes, the network token is still active and viable for transactions. If they do expire or the underlying card account closes, these tokens are invalid and can’t be used for future transactions, limiting the opportunity for fraudsters. 

Network Tokens: Important Considerations

The unique design elements of a network token mean they function slightly differently than traditional payment tokens. While there are many benefits available, (enhanced security plus increased authorization rates being just two), there are a few key considerations to be addressed.

All Network Tokens Are Not Created Equal 

Even though network tokens are based on the same EMV Co. specifications, network tokens are (unsurprisingly) specific to each network. Visa network tokens differ from Mastercard tokens. Provisioning network tokens for Mastercard cards is one integration while provisioning network tokens for other card brands involves separate integrations. So, if you ever thought about integrating network tokens on your own (which is not recommended), you may want to take into account the work required. 

Both third-party orchestrators and PSPs can facilitate these integrations and provision your eligible cards with network tokens. However, some providers can only support 1-2 card brands. If you plan on getting the most value, ensure the provider you choose can support network tokenization for all of the major card brands you accept.

Network Tokens Are Best Suited for Recurring Transactions

Network tokens are best suited for card-on-file solutions and work well for both customer-initiated and merchant-initiated transactions (CITs and MITs). Merchants storing cards on file for recurring transactions will benefit most from network tokenization. Conversely, businesses that process more one-time CIT transactions do not have the same need to store card data or manage the card lifecycle and, therefore, won’t see a substantial benefit from network tokenization. 

Network Tokens Require Cryptograms

In order to achieve reduced fraud rates, network tokens utilize advanced technologies like the cyptogram. Cryptograms come into play when a network token is used in a customer-initiated transaction. This single-use string of characters is generated with the card network and paired with the individual transaction. This is an added layer of security that validates the network token transaction for customer-initiated purchases. 

Cryptograms secure the transaction in real time. In just milliseconds, they validate transactions by verifying the identity of both the card and the approval from the issuer. The cryptogram functions similarly to the CVV and helps the issuer validate legitimate transactions, providing an extra layer of fraud protection. 

Because network tokens are inherently more sophisticated, not all PSPs are equipped to use them, so you won’t be able to use network tokens exclusively. PSPs may also only accept network tokens they provision, though this is happening less and less. 

Network Tokens Cannot Be Provisioned for All Cards

Network tokens offer promising benefits for businesses, but their broad adoption is still nascent. It is estimated that 80% to 90% of issuing banks in the U.S., Europe, and Australia have adopted network tokenization for at least some of their card programs.

While these adoption rates are growing, pairing network tokens with universal tokens ensures the right token format for the job and creates redundancies for merchant transactions. Not all payment gateways, acquiring banks, or payment service providers have the infrastructure to support network tokenization.

By nesting universal tokens alongside network tokens, merchants get the best of all worlds. They can utilize network tokens for their business while falling back to other token formats.

Provisioning Network Tokens with a PSP versus a Payment Orchestration Platform

A crucial consideration for merchants and platforms is whether to provision network tokens with a third-party vault provider (like IXOPAY) or directly with a PSP. Most PSPs (and many other payment orchestration platforms) will often not reveal the underlying network token to the merchant, which limits their value and portability. And while convenient, using a PSP can be more costly than using a provider like IXOPAY.

In order to provision network tokens, a customer must do so under what’s called a token requestor ID (or TRID). This is essentially a license from the card networks to provide network tokens. PSPs will generally provision network tokens for customers under a "shared TRID" model, while a platform like IXOPAY will provide a TRID to each customer. 

A shared TRID may mean network tokens are provisioned a few days earlier, but it ties those tokens to the PSP. IXOPAY provides a TRID to each customer and reveals the network tokens to our customers so they can be used across any PSP that accepts network tokens, and a merchant can even carry them to another vault. 

The key is selecting a tokenization service provider who is truly agnostic and will provision tokens on behalf of the merchant using a dedicated TRID. Almost as important is choosing a provider that releases the underlying tokens to customers when requested. Since IXOPAY provisions network tokens using TRIDs assigned to the merchant, merchants benefit from a PSP-agnostic tokenization solution without the complexity of a top-to-bottom integration with each card network. 

Maximizing the Value of Network Tokens

Network tokens are clearly beneficial to businesses by reducing fraud rates, improving authorization rates, and making card acceptance easier. As a result, adoption rates are growing. However, the challenge is how to approach implementation. 

While viable, provisioning network tokens with a PSP will tie those tokens to the PSP, reducing flexibility for the merchant. As we’ve stated above, maximizing the benefit of network tokens requires some additional consideration and an eye toward the future. The portability, cost-effectiveness, and broad support make working with a payment orchestrator a compelling choice in implementing network tokens.  

Want to learn more about our network tokenization services? Contact us for a demonstration or read our white paper on how network tokenization enhances merchant payment strategies.