What is Tokenization? And its Benefits for E-commerce

Alexis Damen | September 1, 2020

Image source: Burst

Tokenization is not just a buzz-word in the payments industry. With an increase in the types of online payment methods available to customers, it's vital to add an extra layer of security to ensure sensitive credit card data is not compromised.

What is Tokenization?

Tokenization protects sensitive data through a process of replacing the data with a non-sensitive equivalent, known as a token. The token has no external significance or value. It’s a reference — or identifier — that through a tokenization system, maps back to the sensitive data. This process securely collects sensitive credit card information and prevents data theft.

When tokenization is used for credit cards, an algorithm generates a unique random value to replace the customer’s primary account number or PAN. The randomly-generated value is called a token. The tokens safely pass through the Internet or wireless networks to process the payment without exposing credit card details. The credit card number stays safe within a secure token vault.

Chip cards were created to protect your bank information at in-person points of sale. Like chip cards, payment tokenization is designed to provide the same added security to your online purchases. Tokenization and chip cards prevent thieves from getting your credit card information. Read on to learn all about payment tokenization.

How Does Tokenization Work?

Payment tokenization works by creating a secure and unique random ID that has no meaning. There is no correlation between the token and data. If you send the same card information again, you'll get a different token each time. Tokens are usually issued in real-time and used in predefined environments or domains. For instance, the same card will generate one token for use in a specific payment environment, another token for e-commerce transactions. Tokenization doesn’t slow down the payment process because the tokens are issued in real-time.

Using a token to complete the payment, instead of a PAN, makes the payment more secure. A merchant saves only the token in their database for future transactions. Even with a data breach where payment tokens fall into the wrong hands, the PAN stays secure and the tokens are useless to the thieves.

📚 Further reading: How to Accept Payments Online: 6 Step Guide

If you want to store credit card information in your system, without tokens you need to comply with PCI DSS regulations, which is not easy. Using tokens allows you to delegate this responsibility to the payment gateway provider. Payment card industry (PCI) compliance is required by credit card companies to help ensure the security of credit card transactions in the payments industry.

The basic process for payment tokenization looks like this:

At checkout, a customer enters their card information into the secure payment form that is provided by the payment gateway.
The credit card input provided by the payment gateway securely collects credit card information, sends it to the server inside the iframe, and returns a token to the client. An iframe allows you to embed a web page that belongs to a provider and is guaranteed to be secure. This way, your customers can safely enter their credit card information.
The token server sends a response and the token goes into the merchant’s payment system.
The merchant processes the payment with the token that represents the customer’s card data.

Illustration of payment tokenization

At MONEI, we include tokenization with both our Basic and Plus packages. We have two types of tokens:

One time token - Is a token that is used to complete the payment. The user enters credit card details into our card input and we convert the data into a short-lived token that is only valid for one transaction and lasts only five days.
Permanent token - Is a token that is used to store your customers payment method. Using our API, you can request a permanent token. When the transaction is processed you will receive a permanent token in the callback. It represents the user’s credit card details, but never expires and is not bound to a specific transaction. Using this token will allow your customers to make subsequent payments without entering their credit card information again.

What is the Difference Between Tokenization and Encryption?

Tokenization and encryption both help protect data online, but they are two different technologies that are not interchangeable.

Encryption involves rearranging or altering data in a random way. It uses a cryptographic key (a set of mathematical values) that’s agreed on by both the sender and receiver.

Diagram illustrating encryption

Source

While it usually appears random, the process of encrypting data is logical and predictable so the recipient of the encrypted data can decrypt it back to its beginning value. Fully secure encryption involves using complex keys that are difficult to decode, but it is possible to decipher information with the right key.

Both encryption and tokenization are always used together in an e-commerce transaction to secure the end-to-end payment process. Data is mapped (i.e. fields from one database to another are matched) in a database using tokens but the data is also encrypted when you store it. This is a PCI DSS requirement. Let’s take a look at encryption and tokenization side by side to see how they compare.

Tokenization and encryption table

Examples of Tokenization

Tokenization can be used for various types of online transactions. Let’s examine the possibilities of payment tokenization.

Subscription for Billing and Recurring Payments

If your business thrives on subscriptions or other recurring payments, tokenization can benefit you. By using tokenization, you can save your customers’ billing information for their next automatic payment without the liability of keeping all their data on file.

Tokenization allows you to save tokens for your customers and bill them periodically. This gives your customers uninterrupted service while protecting your business.

Ecommerce Sites That Offer Frequent, Returning Customers “One-click” Checkouts

One-click checkouts help retain customers by giving them instant gratification and a smooth checkout experience. One-click checkout has been very popular in online gaming, entertainment, and social networks.

Amazon pioneered one-click checkout using tokenization and patented the process in 1999. The patent on a business process was controversial and has since expired. Many businesses have adopted the practice of one-click checkouts to improve user experiences and retain customers.

According to Statista, 88.05% of e-commerce customers abandoned their carts in March 2020. One-click checkout vastly improves the chances of customers going through with the checkout process by providing fewer obstacles to completing the transaction.

Mobile wallet

Mobile wallets are increasing in popularity and are made possible by payment tokenization. A mobile wallet allows customers to save credit and debit cards for online purchases in a secure environment. Some popular mobile wallets are Apple Pay, Samsung Pay, Venmo, PayPal, Android Pay, Capital One Wallet, Walmart Pay, and Starbucks Wallet.

Some of these are specific to certain brands of devices — Apple, Samsung, and Android. Others are specific to certain stores — Walmart and Starbucks. PayPal is a widely used payment mobile wallet across platforms and stores.

Mobile wallets use tokenization to keep their customers’ data safe while giving them the smoothest possible transaction.

Further reading: Online Payment Methods for Your E-commerce Business

The Benefits of Payment Tokenization in E-commerce

Tokenization can help e-commerce businesses bypass costly red tape, save money, and increase conversion rates by 2.2% according to Cybersource, a Visa solution. Credit card fraud adds up to major costs for businesses. Payment tokenization can help reduce fraud by nearly one-third and protect your business from costly data breaches.

Cybersource payment tokenization stats

Let’s examine the benefits of tokenization:

Compliance - If you’re storing credit card information, it’s crucial to be PCI DSS compliant. Tokenization can help keep data secure. For example, data tokenization can help keep you in compliance with PCI DSS, or Payment Card Industry Data Security Standard.
Reduced risk - If your business suffers a data breach and is holding customer financial data, you could be found responsible and open yourself up to lawsuits. Tokenization allows you to store customer data in a way that’s safe for you and your customers.
Added security from mobile wallets - Tokenization that takes place through third-party apps add an extra layer of security from the mobile devices your customers use. They have to use an added layer of biometric data or a password to access their mobile wallet before moving forward to your site.
Build trust with your customers - Over half of consumers said a data breach had negatively impacted their trust in a company, according to a 2018 study from CA Technologies/Frost & Sullivan. Tokenization allows your customers to trust that you’re safeguarding their information by not storing any of their actual financial information.
Ability to accept recurring or subscription payments - With payment tokenization, you can securely accept subscription or recurring payments in your e-commerce business. Sensitive card data is converted into random values that can’t be decoded outside the tokenization systems. This way you can store credit card data for future purchases and streamline subscription payments for you and your customers.

Tokenization and Your Business

If you’re ready to keep your customers’ data secure, improve their checkout experience, retain more sales, and have pre-made compliant solutions, it’s time to look into payment gateways like MONEI.

Alexis Damen

Alexis Damen is the Head of Content at MONEI. She loves breaking down complex topics about payments, e-commerce, and retail to help merchants succeed (with MONEI as their payments partner, of course).

#Payment Security #Fintech