Network tokens

What is network tokenization?

Network Tokenization is a service introduced by card networks such as Visa, Mastercard, and American Express. It is a payment method in which the card number (PAN) is replaced with a secure token of the network and used in payments with higher security levels than traditional PAN.

Benefits

Network tokens are known to have higher security and authorization rates, reduced fraud, and improved customer experience.

Increased Security

Network tokens reduce the risk of data breach exposure since the real card PAN is not stored. In addition, each payment is secured by a unique cryptogram also generated by the networks. You can see more details regarding the cryptogram in the relevant section of this guide.

Increased Authorization Rate

Network tokens are proven to have higher authorization rates than tokens issued by payment service providers or token providers, as they are issued by the networks, eliminating potential declines by them. With Network tokenization, there is a reduced scope of SCA requirements. Fewer challenges or step-up authentications cut payment friction and improve authorization rates and payment success.

Reduced Cost

The cost of interchange fees charged by the networks for merchants is lower for the network tokens, as the networks encourage the usage of network tokens, given their benefits for the payment ecosystem. The costs are reduced for the card-not-present network token transactions by an average of ten basis points.

Increased User Experience

Network tokens ensure a frictionless payment experience with automatic renewal and real-time card life cycle management features. Network tokens are updated by the card network when there is a change on the card, such as when a card is renewed after its expiration, reissued due to being lost or stolen, or any other case that makes the card change. This feature ensures that the card that is held on file in the merchant does not need to be updated manually by the cardholder on each merchant’s site but can be updated automatically by the merchant, ensuring a frictionless customer experience.

Merchants can use the card art and thorough issuer/card information to design a better user experience and interface in their checkout. With network tokenization, it is possible to request the graphical details of a payment card, as well as BIN data such as card brand, type, issuer name, or country.

👍

The service allows merchants to tokenize cards entered by consumers during checkout or existing card held on file. That means, you can start using network tokens anytime, and benefit for including the existing customer base.

How to start using network tokens

Step 1: Register to the Card Networks

The first step is for the merchant to set up a connection and configuration with the networks. Payrails works as an on-behalf-of token requestor and handles the heavy lifting of the integrations with the networks for the merchants. Meanwhile, Payrails merchants become the Token Requestor, to which the ownership of the tokens belongs to them.

Each network has a different onboarding process, requiring a different set of information. Payrails handles this complexity and provides a network-agnostic onboarding process to its merchants. All the merchant has to do is decide which networks to provision network tokens and get onboarded to the networks via the Payrails Portal by providing the network-specific information that needs to be submitted.

Onboarding to a Network as a Token Requestor

You can get onboarded to a network in the Payrails Portal by providing the requested fields by the networks. Payrails Portal will display the required fields for each network and will connect to networks to generate a Token Requestor ID for your business. If you already have a Token Requestor ID, please contact your Payrails support team to help you with the setup.

Step 2: Provision Network Tokens

Network tokens are typically created as a token under a payment instrument alongside its vault tokens and other token types that an instrument may have. Visit our payment instruments guide for more information. Once you integrate tokenization via Payrails (such as Client-side encryption or Secure Fields), you will be able to pass a parameter to provision a network token during an instrument creation as well as be able to request to add a network token for an existing payment instrument. Visit our how to tokenize cards guide to select the best tokenization method for you.

When a Network Token provision is requested, card details will be sent to the network via Payrails, and the network token which is considered sensitive data will be stored securely in Payrails Token Vault. Payrails will generate a network token reference and attach it to the payment instrument.

Step 3: Use Network Tokens in Authorization

Payrails helps its merchants identify the optimal rules according to their business performance and goals. Cost, authorization rate, and user experience are the three most important aspects that will potentially be optimized. You can configure a default behavior if you want to use network tokens in every authorization request to Payrails or choose Payrails smart logic to decide it for each request.

Payrails Token Vault will store network tokens and request a secure and one-time use cryptogram from the networks when a network token is decided to be used for payment authorization. Payrails will obtain a secure cryptogram for each particular transaction that a customer initiates, and remove the cyrptogram after usage. For merchant-initiated payments, typically cryptogram will not be needed.

Note that, the cryptogram requirement differs from one network to the other. It will be always required to process customer-initiated transactions (CIT) and will be required for subsequent subscription/recurring merchant-initiated transactions (MIT) for some of the networks, for certain conditions. Payrails handles all the network token service provider-specific requirements on behalf of the merchant and steers the merchant integration flow accordingly.

Send network token and cryptogram to the payment service provider

After obtaining the network token and the cryptogram, Payrails Vault passes them to the payment service provider to process the payment, which then will be passed to the acquirer, followed by the issuer, where the merchant receives all the results of the payment rails. You can review the sequence diagram below to see the merchant's action points as well as Payrails' communication points with the networks and payment service providers.

Update network token with the lifecycle management events

When a cardholder or Issuer of the card makes a change in the card that has a network token in our system, it is a requirement to update the network token so that the network token will be kept valid. Payrails will be notified by the networks in case of an update and will update the network token in the vault accordingly. No additional action will be required by the merchant, however, you can choose to be notified of the updates through our notifications.

Integration Type Options for Network Tokens

Alongside using network tokens as part of payment orchestration, it is also possible to integrate to use them inside a proxy flow or to receive the network token-sensitive data, if the merchant's PCI DSS certification level allows. There are multiple ways Payrails provides their merchants to use Network Tokens, depending on your needs and your current or targeted PCI DSS scope: