What Are Network Tokens?

So what are network tokens, compared to tokenization in general? Tokenization, broadly, is replacing a card number with a stand-in token so the real number does not have to sit in a merchant's or gateway's systems — see Tokenization in Payments for that wider definition.

Network tokens are one specific kind: the token is issued and managed through a card network's token service, such as Visa Token Service or Mastercard MDES, rather than solely within a merchant's gateway or a third-party vault. Because the network itself controls the token, it can keep the token linked to the cardholder's account even after the physical or virtual card behind it changes.

Network tokens vs merchant or gateway tokens

Gateway tokens are typically issued and managed by a payment gateway or tokenization provider. The real card number is stored in a secure vault, while the merchant's systems receive a reusable token.

Network tokens are provisioned through card-network token services. A gateway, PSP, wallet, or merchant may request the token, while the card network's token service manages the token mapping and lifecycle. A merchant can use both a gateway token for its own systems and a network token for payment processing.

How card networks issue network tokens

Visa's version is the Visa Token Service (VTS); Mastercard's is the Mastercard Digital Enablement Service (MDES). Both work on the same idea: the network generates a token tied to a specific card and use case — say, a particular merchant or wallet — and that token moves through the payment flow instead of the actual card number.

Only the network can translate the token back to the real card details when the payment is authorised.

Why network tokens help with card reissues

Cards get reissued for ordinary reasons: expiry, a lost card, a reported breach. Normally that breaks any stored card number a merchant was reusing for subscriptions or one-click checkout, until the shopper re-enters new details.

Because the network controls the token directly, it can update the token to point at the reissued card without the merchant doing anything, which can help approval on stored-credential payments — recurring billing, saved cards — since the merchant is no longer charging a token that quietly stopped working.

Network tokens and PCI scope

A network token is not the underlying card number. A system that handles only the token and never stores, processes, or transmits the PAN keeps less raw card data in its own environment.

Using network tokens may therefore help reduce PCI DSS scope, depending on the implementation and payment data flows. Tokenization does not automatically remove PCI DSS responsibilities, because systems that handle the original card data or provide tokenization services may still remain in scope.

Where this sits at Payneteasy

Payneteasy's tokenization currently runs inside its PCI DSS Level 1 gateway. Network tokens issued through card-network token services are not currently available as a Payneteasy feature. This glossary entry explains network tokens at the industry level; it should not be interpreted as a claim that Payneteasy currently issues or manages them.

For a broader explanation of payment tokenization, see Tokenization in Payments. To compare network tokens with gateway tokens and independent token vaults, read How to Choose a Payment Tokenization Service Provider.