tokenisation
Tokenisation replaces a card number with a substitute value, the token, that the business or platform can store and use to charge the card again. The real card details stay with the regulated provider or the card scheme, so the business never holds them and its PCI scope shrinks.
A business that wants to charge a customer again, for a subscription, a balance, a no-show or a repeat order, needs something to charge. Storing the card number itself brings the full weight of PCI DSS and a serious breach risk. Tokenisation gives the business a token instead: a value that means "this card" to the provider and nothing to anyone else. Scheme tokens, issued by Visa and Mastercard, go further and update themselves when the card is reissued, so a replaced card keeps working.
Why it matters to a software platform: saved cards are one of the two things that stop a customer moving providers, the other being Direct Debit mandates. Each token belongs to the provider that issued it. Moving customers from one provider to the platform's own payments means either migrating tokens, which some providers will do on request and under scheme rules, or asking each customer's customer to enter their card again at a moment that makes sense. Which route is available decides how the move is planned.
What to watch: a token created after an authenticated first payment supports merchant-initiated charges without further SCA; a token created without authentication may not. Set up tokenisation and 3-D Secure together, and record the agreement the customer gave to be charged later.
Sources
- FCA, Strong customer authentication, 17 February 2023