Tokenization refers to the process of encrypting sensitive information by replacing the details with random strings of characters. These random character strings are generated by algorithms and are referred to as tokens.
Tokens can be used as a more secure method of data transfer, such as a customer’s credit card or bank account information. Rather than the raw data being exposed, the same information in tokenized format can be passed through a payment gateway instead.
Keep in mind we’re not talking about a crypto token or cryptocurrency here.
What is tokenization and what purpose does it serve? Some security methods, like the computer chips in credit cards, are designed to stop hackers from replicating banking details onto another card. The main goal of safeguarding data through tokenization, however, is to prevent online data breaches.
How Does Tokenization Work?
With regard to payment processing, tokenization requires a credit card or account number to be substituted with a token. The token itself isn’t connected to any person or account.
The 16-digit primary account number (PAN) of a customer gets replaced with a custom-made string of random numbers, letters, and special characters. This process eliminates any connection between customer data and a transaction.
Payment tokenization safely stores bank account numbers or credit card numbers in a virtual vault. This allows for the safe transmission of data through wireless networks. Organizations need a payment gateway to effectively make use of tokenization.
Payment gateways are services offered by e-commerce applications that double as tokenization service providers. They allow for direct payments or the processing of credit card payments. This kind of gateway can store credit card numbers in a safe manner and generate the random tokens needed for payment tokenization.
Tokenization vs Encryption
How is tokenization different from encryption? Both methods involve protecting information from prying eyes, but how they go about doing this is quite different.
While encryption uses a “key” to protect data, tokenization uses a “token.” One method makes data opaque, with the intention of revealing it later through use of a special decryption key. The other method uses random data to represent real data.
Encryption
Encryption can be reversed. Data that has been encrypted is intended to be decrypted at some point and restored to its initial state. How strong the encryption will be depends on the complexity of the algorithm used to encrypt the data.
All encryption can theoretically be broken. The stronger the encryption algorithm, the more difficult it will be to break. But given sufficient computing power, an attacker can overcome just about anything. Encryption serves to obfuscate data but doesn’t protect it completely. When something is encrypted, it becomes more difficult to access — but not impossible.
Tokenization
Tokenized data can’t be reversed. Tokenization involves substituting sensitive data with random data, so there’s nothing to decrypt. A token simply holds the place of other data and has no real value.
The real data can remain in a different location such as an offsite platform. The original data doesn’t have to be kept inside an online computer network at all. If the tokens are compromised, an attacker has gained nothing. Tokens are useless to criminals.
| Benefits | Tokenization | Encryption |
|---|---|---|
| Reversible | X | |
| Refunds, chargebacks, subscriptions | X | |
| Low-cost per transaction | X | |
| Centrally controlled | X | |
| Established security | X | |
| PAN data displayed | X |
What Are Some Examples of Tokenization?
When a credit card transaction is processed, the primary account number (PAN) gets substituted with a token. For example, 1234-2323-3434-5454 might be replaced with 6^fjk8Nm$zqGa.
A merchant can then use this token ID to retain customer records, like connecting the 6^fjk8Nm$zqGa token to Bob Smith. The token then gets sent to the payment processor who de-tokenizes the identification and confirms the transaction. 6^fjk8Nm$zqGa turns into 1234-2323-3434-5454 again.
Only the payment processor can read the token, making it useless for outside parties. The token can only be used with one merchant.
Here are some more specific examples of using tokenization payment.
Apple and Android Pay
With payment apps like Apple Pay or Android Pay, you first take a picture of your credit card and upload it to your phone. Then the payment processor (either Apple for Apple Pay or Google for Android Pay) sends the details to the bank who issued the credit card, which then tokenizes the card’s details. The token is then sent to Apple or Google before being programmed into the phone. This way, the number stored in the payment app can’t be of any use to attackers.
Tokenization Within Apps
Some apps allow for direct in-app purchases on a mobile device. If the phone has a token, such apps won’t have access to any raw credit card information. Not only does this kind of tokenization of payment prevent data from being useful to criminals, but it also makes payments easier. A tokenized account can be linked to your stored payment and shipping information, making the process quicker the next time around.
Tokenization in eCommerce
Tokenization helps protect consumers when they shop online, too. For example, when someone buys a product from a retail website, the retailer tokenizes the card information and keeps it on file. The data is safe even if it were to be hacked. If an attacker gains access to the system, all they will be able to see is random strings of characters.
Tokenization ensures these types of transactions can happen in a way that most benefits customers in terms of both safety and speed.
Benefits of Tokenization
Merchants and their customers benefit from tokenization in many ways, notably additional security, reduced costs, and a better user experience.
Additional Security
Today, cybersecurity often functions from a perspective of assuming that breaches are likely to occur. Because of how tokenization works, even if hackers access tokenized data, they probably still won’t be able to use it. The data would have to be decrypted first to be of any use. In this way, tokenization minimizes the risk of a data breach being harmful to a merchant or its customers.
Reduced Costs
Merchants can save on some of the costs that come with payment card industry (PCI) regulatory compliance by working with the right tokenized service providers. Protecting a company’s reputation by securing customer data can also prevent losses down the road, should something go wrong.
Better User Experience
Tokenization allows customers to store their credit cards in mobile wallets or at checkout for online payments. Cards can then be charged again without having to expose the original information. Merchants can provide a smoother customer experience this way because tokens can be used as payment for recurring subscriptions and one-click payments.
The Takeaway
Tokenization works by replacing real information with random characters called tokens. The tokens can then be used to process payments. There are a number of advantages to tokenization, especially over encryption — notably, while encryptions are made to be deciphered, tokenization is not.
There’s a lot to know when it comes to securing your transactions, finances, and investments. With a SoFi Invest® brokerage account, you can build your portfolio by securely trading your choice of stocks, exchange-traded funds (ETFs), and Initial Public Offerings (IPOs).
Photo credit: iStock/paulaphoto
SoFi Invest® INVESTMENTS ARE NOT FDIC INSURED • ARE NOT BANK GUARANTEED • MAY LOSE VALUE
1) Automated Investing and advisory services are provided by SoFi Wealth LLC, an SEC-registered investment adviser (“SoFi Wealth“). Brokerage services are provided to SoFi Wealth LLC by SoFi Securities LLC.
2) Active Investing and brokerage services are provided by SoFi Securities LLC, Member FINRA (www.finra.org)/SIPC(www.sipc.org). Clearing and custody of all securities are provided by APEX Clearing Corporation.
For additional disclosures related to the SoFi Invest platforms described above please visit SoFi.com/legal.
Neither the Investment Advisor Representatives of SoFi Wealth, nor the Registered Representatives of SoFi Securities are compensated for the sale of any product or service sold through any SoFi Invest platform.
Financial Tips & Strategies: The tips provided on this website are of a general nature and do not take into account your specific objectives, financial situation, and needs. You should always consider their appropriateness given your own circumstances.
Crypto: Bitcoin and other cryptocurrencies aren’t endorsed or guaranteed by any government, are volatile, and involve a high degree of risk. Consumer protection and securities laws don’t regulate cryptocurrencies to the same degree as traditional brokerage and investment products. Research and knowledge are essential prerequisites before engaging with any cryptocurrency. US regulators, including FINRA , the SEC , and the CFPB , have issued public advisories concerning digital asset risk. Cryptocurrency purchases should not be made with funds drawn from financial products including student loans, personal loans, mortgage refinancing, savings, retirement funds or traditional investments. Limitations apply to trading certain crypto assets and may not be available to residents of all states.
Investing in an Initial Public Offering (IPO) involves substantial risk, including the risk of loss. Further, there are a variety of risk factors to consider when investing in an IPO, including but not limited to, unproven management, significant debt, and lack of operating history. For a comprehensive discussion of these risks please refer to SoFi Securities’ IPO Risk Disclosure Statement. IPOs offered through SoFi Securities are not a recommendation and investors should carefully read the offering prospectus to determine whether an offering is consistent with their investment objectives, risk tolerance, and financial situation.
New offerings generally have high demand and there are a limited number of shares available for distribution to participants. Many customers may not be allocated shares and share allocations may be significantly smaller than the shares requested in the customer’s initial offer (Indication of Interest). For SoFi’s allocation procedures please refer to IPO Allocation Procedures.
Exchange Traded Funds (ETFs): Investors should carefully consider the information contained in the prospectus, which contains the Fund’s investment objectives, risks, charges, expenses, and other relevant information. You may obtain a prospectus from the Fund company’s website or by email customer service at [email protected]. Please read the prospectus carefully prior to investing.
Shares of ETFs must be bought and sold at market price, which can vary significantly from the Fund’s net asset value (NAV). Investment returns are subject to market volatility and shares may be worth more or less their original value when redeemed. The diversification of an ETF will not protect against loss. An ETF may not achieve its stated investment objective. Rebalancing and other activities within the fund may be subject to tax consequences.
Third-Party Brand Mentions: No brands, products, or companies mentioned are affiliated with SoFi, nor do they endorse or sponsor this article. Third-party trademarks referenced herein are property of their respective owners.
SOIN1021417