Network tokens: securing flows and improving acceptance

Card schemes have announced it, regulators are aligning, and merchants are already seeing it in their authorization rates: clear-text Primary Account Numbers (PAN) are a thing of the past. Visa has set a clear course to phase out the PAN by 2030, and Mastercard is on the same trajectory. For e-merchants, the goal is simple to state but demanding to implement: secure payment flows without compromising acceptance rates.

Network token, merchant token, and PSP token: stop getting them mixed up

When we talk about "tokens" in payments, several concepts coexist. Three are tokens in the strict sense, to which we must add an identification reference that is important to distinguish.

• The merchant token is generated and stored on the merchant's side, usually linked to an internal customer identifier (account, profile, subscription). It is used to recognize returning customers without handling clear-text card data.
• The PSP token is issued by the payment processor. It allows the merchant to delegate the storage of sensitive data to their provider and reduce their PCI DSS scope. Today, this token often acts as a gateway: it is what triggers, behind the scenes, the creation of a network token on the scheme side.
• The network token (or payment token according to the EMV Payment Tokenisationspecification) is issued by the card network itself: Visa, Mastercard, American Express, and now CB, which has launched its own program in line with the "CB of tomorrow" initiative. It has its own expiration date and a single-use cryptogram.

In addition to these three tokens, there is the PAR (Payment Account Reference), which is not a token but a common reference for all tokens derived from the same card. It serves as a thread to reconcile transactions, channels, or customer journeys without ever handling sensitive data.

In practice, the network token travels in place of the PAN throughout the authorization chain. It is linked to a specific Token Requestor ID (TRID): a merchant, a wallet, or sometimes an orchestrator. This granularity is what makes network tokens both robust and complex to scale.

Why card schemes are accelerating in 2026

Three forces are pushing network tokenization to the top of payment priorities.

Reducing the security footprint (De-scoping). PCI-DSS certified environments are fortresses today, but maintaining them is expensive and places a heavy burden on payment stakeholders. The logic of card schemes (Visa, Mastercard) and regulators (via PSD3) is no longer just about protecting the card number, but about making it disappear from merchant systems entirely. The goal: replace the PAN with a token that, even if leaked, would be completely unusable outside its original context. This "de-scoping" approach is detailed in our article on best practices for securing payment data.

Pricing incentives. Visa and Mastercard now apply mandates (penalties) on transactions still processed using a PAN. On an average basket of €86, these penalties represent between 4 and 6 cents per transaction. Be aware that this extra cost is often invisible to merchants : many acquirers hide it or bury it within their overall fee structures. To encourage the transition, the carrot sometimes replaces the stick: the recent VDCAP (Visa Digital Commerce Authentication Program), launched in April 2026, goes even further. It combines the use of network tokens with high-quality contextual data (device ID, IP, email) to offer up to 0.10% direct reduction in interchange fees.

The tightening of hard declines related to risk scoring. With the evolution of issuing banks' anti-fraud algorithms and the ongoing requirements of PSD2, issuers are increasingly and systematically rejecting authorizations deemed risky or lacking sufficient data context. Because network tokens are encrypted and natively linked to a specific merchant, they send a maximum signal of trust to the bank. Without this token, a standard PAN flow (especially for stored cards) is much more exposed to these hard declines from banking algorithms.

Three measurable benefits for acceptance

1. The card updates itself

This is the most immediate benefit from Visa and Mastercard. When a card is renewed, lost, or replaced, the international network automatically propagates the update to the token. Merchants are thus freed from the need to ask customers to re-enter their 16-digit numbers or to systematically rely on an external update service for these flows. For subscription models, this continuity alone accounts for a significant portion of churn prevented. It should be noted that for the national network, the choice remains open: dedicated solutions like CB's Account Updat'R allow cards to be updated without requiring a switch to network tokens, leaving merchants to choose the best acceptance strategy.

2. A higher authorization rate

Issuing banks inherently trust tokenized flows, as the data is secure and natively linked to the merchant. Visa and Mastercard rely on this reliability to anticipate acceptance gains of 1 to 3 percentage points. However, in a market as mature as France, capturing this performance depends on the speed of technical homogenization across all banking players. While improving acceptance remains the clear goal of tokenization, it currently requires an expert integration strategy. The key lies in intelligent flow management (A/B testing, orchestration, and controlled management of fallbacks) to support the market and gradually transform this evolution into additional revenue.

3. Security by design against data breaches

Rather than addressing risk after the fact, the network token integrates protection directly at the source. It is technically restricted to a strict scope: the merchant, device, or channel for which it was issued. Just as dynamic CVV cards do for standard payments, the network token secures the digital ecosystem by relying on a unique cryptogram generated for every transaction. The result: a token stolen outside its original context is inherently unusable, which technically neutralizes the risk associated with database leaks.

‍

Pitfalls to anticipate before switching

Moving network tokens into production requires making a few key structural decisions.

Generation mechanics and the first transaction. Historically, token creation sometimes required asynchronous management to handle network throughput limitations. Today, these constraints have largely been lifted, and synchronous calls are the standard. In practice, orchestration usually works like this: the customer's very first transaction is processed using the clear-text PAN. It is during this initial validation that the network token creation is triggered synchronously with the scheme. Once generated, this token takes over seamlessly to secure all subsequent customer transactions (1-click flows, subscriptions).

Managing the fallback and dual storage. Because the ecosystem is still fragmented, not all PSPs support network tokens perfectly. The operational reality for an orchestrator is therefore to continue storing the PAN (in an ultra-secure environment) alongside the token. This is where an agnostic vault proves its worth: by keeping both, it allows for the dynamic use of one or the other depending on the capabilities of the targeted processor. If a PSP does not handle the token, or if the network's tokenization service experiences downtime, the system instantly switches to the PAN. Without this storage and routing flexibility, merchants risk avoidable payment failures.

Co-badged cards and customer choice. In France, most cards carry both the CB brand and an international network (Visa or Mastercard). In accordance with regulations, the choice of network must be left to the customer during checkout. This detail is crucial for your tokenization strategy: the network (scheme) selected by the buyer during their first transaction defines the token's context. This specific choice must be saved and reused for all subsequent payments (recurring purchases, one-click). The technical challenge is therefore to ensure that your vault or orchestrator respects this initial selection from end to end.

Network tokens and 3D Secure: a strengthening duo

Network tokens do not replace strong customer authentication; they complement it. A tokenized and 3DS-authenticated transaction benefits from the most protective liability shift on the market. Better yet, new approaches like Mastercard TAS or Visa passkeys rely directly on network tokens to orchestrate native browser biometrics without visible redirection. This combination is where the next wave of checkout optimization will take place. To learn more, see our article Security and PSD3 compliance: everything e-merchants need to know.

Orchestration: a lever for a sovereign token strategy

PSP fragmentation is the natural enemy of the network token. Each processor has its own vault, its own tokens, and its own rules. When a PSP becomes unavailable or a contract changes, the tokens created are not portable, causing the merchant to lose both their card-on-file data and continuity of acceptance for their customers.

This is precisely the role of an agnostic vault operated at the orchestrator level:

• a TRID backed by the orchestrator, feeding all of the merchant's PSPs;
• a token that is reusable from one PSP to another, including for retries or fallbacks;
• a unified view of enrolled cards, independent of the final processor.

This logic is part of a broader approach topayment orchestration and resilience multi-PSPIt determines a merchant's ability to activate network tokens at scale without being locked into a single provider.

What lies ahead for network tokens

Network tokenization is not the end goal. Three new initiatives are already underway.

• Click to Pay, which leverages network tokens to offer a seamless, card-free checkout experience, harmonized across all schemes.
• Visa and Mastercard TAS passkeys, which transform authentication into a native, frictionless biometric interaction, eliminating those dreaded redirects to banking apps.
• Agentic tokens, currently in development, designed to handle specific controls for transactions initiated by AI agents: a topic covered in our article on agentic commerce.

For merchants, the right approach is not to wait for widespread adoption, but to align their architecture (vault, orchestration, data quality) with a standard that will define the coming decade.

‍