Tokenization Infographic

Tokenization is one innovative technology that banks use to protect customers from fraud.

Other Technologies

• EMV chip: creates unique cryptogram for each transaction
• Encryption: codes data so that only verified parties can read it

3 Ways to Pay

• online: mobile or web
• smart phones: NFC, QR, Bluetooth
• card

3 Types of Fraud

45% card not present

• Account data is used (primarily at online retailers)
• Fought by encryption and tokenization

38% counterfeit

• Card duplicated using account data
• Fought by both encryption and EMV

13% lost or stolen

• Fought by signature or pin

4% other

Why Use Tokenization?

• Replaces sensitive customer account data with a secure alternative, or a token. A token is a unique number that is useless if stolen.
• Takes place instantly behind the scenes and requires no action by the customer.
• Runs on payments systems that are in use today.

Personal account number (usable if stolen) vs. token (useless to thieves)

How Are Tokens Issued?

• When a customer makes a transaction, their account number passed through the network.
• The network verifies the account information with the bank.
• The network issues a token to replace the account number.

How Does a Tokenized Transaction Work?

1. When paying — either via online purchase or tap-to-pay — the token goes to the Merchant.
2. The Merchant passes the token along to their Merchant Acquirer.
3. The Merchant Acquirer passes the token to the Network.
4. Once passed to the Network, the data is within the secure bank vault.
5. The Network consults its "Token Vault" to match the token with the customer's account number.
6. The Network passes along the token and personal account number to the Bank.
7. The Bank verifies funds and authorizes the transaction.
8. The authorization is passed to the Network and proceeds back to the Merchant Acquirer and to the Merchant.

Tokens Are Useless if Stolen

Tokens can be configured so that they are only good for transactions that fit specific criteria

• good for a set period of time
• good only from a specific retailer
• good for only a certain dollar amount

Even if the retailer systems are compromised, thieves can only get tokenized data. Since tokenized data is useless to a fraudster, the customer is protected despite the data breach.

After a data breach, if a token is used elsewhere, the Network can detect the token as stolen and will reject the fraudulent transaction.

Although customers may not see it, banks are adopting many invisible technologies to protect against fraud. Tokenization is one technology that banks are using to protect customers when they pay online or with their smart phone.