Payment Tokenization: How Mobile Wallets Protect Card Data
Add a card to a phone wallet and the 16-digit number printed on the plastic stops travelling with your purchases. The terminal, the shop's systems and the shop's payment processor receive a substitute number that works only under narrow conditions. That substitution is payment tokenization, and it decides how much of your real card data a merchant ever touches.
In October 2025 Visa reported more than 16 billion tokens, up from 10 billion in May 2024, against about 4 billion cards on its network. One card usually sits behind several tokens: one per phone, one per watch, one per shop that keeps it on file.
What changes when a card is tokenized
A card number, or PAN (primary account number), identifies your account to every party in a payment, and anyone who copies it can try to use it elsewhere. A token is a stand-in value that a token service maps back to the PAN during authorisation, and nowhere else.
How does card tokenization work in practice? Take a hypothetical shopper. Ana, in Zagreb, adds her payment card to her phone wallet. Her issuer's token service creates a device payment token for that phone and stores it in the phone's secure chip. A week later she taps the phone to buy a ferry ticket at a kiosk in Split. The kiosk receives the token plus a one-time code for that tap; the card network swaps the token for her card number, checks the code and forwards the request to her issuer.
The ferry operator keeps a token and a receipt. If its systems were breached, the attacker would hold a number the network rejects unless it arrives from Ana's phone with a fresh code. That is where the payment token vs card number distinction pays off. People often say credit card tokenization, but the mechanism is identical for any payment card.
Device tokens and merchant tokens
Two kinds of token share one name, and they protect different things.
A device token comes from network tokenization: a card scheme's token service creates it for one device, and every payment carries a cryptogram that changes each time. Mobile wallet tokenization is the familiar example. Can a payment token be reused? A device token is reused for every purchase from that phone; the one-time code attached to each purchase is not. Not every token is single-use.
A merchant token, or vault token, is created when a shop or its processor stores your card for later. The real number sits in the processor's vault; the shop holds a reference that means nothing outside that relationship. Visa describes this as a token that can only be used with that merchant. It works like a cloakroom ticket: it gets your coat back from that cloakroom, it is worthless at any other, and the ticket itself reveals nothing about what is in your pockets.
The two often stack. A language-learning app in Lisbon may keep a network token for your card in its processor's vault. If the card is reissued, the issuer can refresh the credential behind the token and the subscription keeps charging – convenient, and the reason a replaced card does not automatically stop recurring payments.
Tokenization vs encryption vs authentication
Is tokenization the same as encryption? No. Encryption scrambles data so that only someone with the key can restore it. Tokenization replaces the data with a different value held elsewhere. Authentication answers a third question – is the payer the cardholder? – through a fingerprint, face scan, PIN or 3D Secure. The tokenization vs encryption confusion fades once you see that one wallet payment uses all three.
horizontal scroll
| Tokenization | Encryption | Authentication | |
|---|---|---|---|
| Question it answers | Which stand-in replaces the card number? | Who can read the data? | Is the payer the cardholder? |
| What it produces | A substitute number valid in a limited context | Scrambled data readable with a key | A pass or fail, often backed by a one-time code |
| Can the original be recovered from it? | Only through the token service's mapping | Yes, with the key | Not applicable |
| In a phone wallet | Device Account Number stored in the secure chip | Card details encrypted when the card is added | Face ID, fingerprint, passcode or 3D Secure |
Tokenization, encryption and authentication each handle a different part of a card payment.
Source: Apple, Apple Pay security and privacy overview, 2025
Tokenized card payments still follow authentication rules. Does tokenization replace 3D Secure? No. Most online card payments in the EU need strong customer authentication under PSD2; a wallet payment can meet it through biometrics on a device your issuer trusts, and a shop can also run a tokenized card through 3D Secure.
Does Apple Pay use tokenization?
Does Apple Pay use tokenization in shops as well as online? Yes, in both. When you add a card, your issuer creates a Device Account Number and stores it, encrypted, in the Secure Element, a certified chip in the phone or watch. Apple's security overview says that number is isolated from the operating system, never stored on Apple's servers and never backed up to iCloud.
At the till, the chip sends the Device Account Number with a dynamic security code unique to that transaction; the card number is never transmitted. Online, the data is re-encrypted for the specific merchant or its processor.
Blackcat payment cards can be added to Apple Pay; setup is covered on the secure card payments page.
When the phone goes missing
What happens to a token when a phone is lost? It stays bound to that device, and you can switch it off without touching the card, because the card and the token are separate credentials.
- Mark the device as lost. On an iPhone, Lost Mode in Find My suspends Apple Pay until you re-enable it.
- Remove the cards remotely from your Apple Account page, or erase the phone through Find My.
- Contact your issuer through its app or a verified number. It can suspend the device token even if the phone is offline.
- Check recent transactions and report anything you did not make.
In a hypothetical case, Jonas leaves his phone on a night tram in Vienna with his card still in his jacket. Find My and a message to his issuer suspend the token, and he pays with the plastic card next morning. A new card is needed only if the card or its details went missing too.
What tokenization does not stop
Does tokenization prevent every type of fraud? No. It limits what a data thief can steal, but does nothing about a payer tricked into approving a payment. The EBA and ECB 2025 report on payment fraud put fraud on EU/EEA-issued cards at €1.33 billion in 2024, with remote transactions behind 83% of card fraud value but only 28% of card transaction value. It also flagged the manipulation of payers as a growing problem.
Three patterns get past them:
- Wallet activation scams. A caller posing as your card provider asks for a one-time code that was sent because someone is adding your card to their own phone.
- Fake shops. A tokenized payment to a fraudulent merchant is still a valid payment.
- Persuaded approvals. You confirm a payment in your own app under pressure, and the authentication is real.
Key takeaways
- Merchants store the token, not your card number.
- Device tokens live on one device; merchant tokens live in one shop's vault.
- Tokenization does not replace encryption or 3D Secure.
- A lost phone can be cut off without replacing the card.
- Scams that get you to share a code or approve a payment bypass tokens.
Check your card controls
Wallets protect the card number; your settings protect the rest. See the controls available in the app in the Blackcat card security guide.
FAQ
What does payment tokenization change about the card data a merchant receives?
A token and, for wallet payments, a one-time code instead of your card number. A stolen token has little value outside its device or merchant.
How does a payment token differ from a card number?
A card number works everywhere. A token is limited to one device or merchant, only the token service can map it back, and it can be suspended without cancelling the card.
What is the difference between tokenization and encryption?
Encryption scrambles data that a key can restore. Tokenization swaps it for a different value held elsewhere.
How do device tokens and merchant tokens differ?
Device tokens belong to one phone or watch and carry a fresh code per payment. Merchant tokens are references one shop holds for a stored card.
Can tokenization and 3D Secure be used together?
Yes. Tokenization protects the data; 3D Secure or wallet biometrics confirm who approved the payment.
What should I do if I lose a phone containing payment cards?
Put the device in lost mode, remove the cards remotely, contact your issuer through a verified channel and review recent transactions.
Which scams can still affect a tokenized payment?
Wallet activation code scams, fake shops and payments you are persuaded to approve yourself.
What is payment tokenization?
Replacing a card number with a stand-in value that is mapped back to the real card only during authorisation.
