What is Tokenisation? | Finero Glossary

Tokenisation replaces sensitive payment details, such as a card number, with a meaningless substitute value called a token, which can be stored and reused without exposing the original data.

Why it matters in B2B collections

Tokenisation is what makes stored payment methods safe to hold. The token is useless if stolen, because it carries no mathematical relationship to the underlying card number: it can only be exchanged for a real charge by the specific provider that issued it, on the specific merchant account it was issued for. That property is what lets a business charge a customer on a due date without ever holding the card itself.

Payment-provider architecture matters

Tokenisation is a payment-provider concept. Its use depends on the provider and integration architecture. With provider-hosted payment pages, buyers enter their payment details directly with the payment provider.

Gateway tokens and network tokens are different things

A gateway token is issued by your payment provider and is generally valid only with that provider, which is why migrating processors means re-tokenising, a process the incumbent provider is rarely eager to help with. A network token is issued by the card scheme itself and is updated automatically when the underlying card is reissued or its expiry changes. For recurring B2B billing that second property matters, because it removes a whole category of avoidable failed payments.

Tokenisation is not encryption

Encrypted data is still the original data, mathematically transformed, and it can be returned to plaintext by anyone holding the key. A token contains no recoverable relationship to the value it replaces: it is a reference, and the mapping lives only in the provider's vault. That distinction matters in a breach. Stolen encrypted data is a key-management problem. Stolen tokens are, on their own, close to worthless.

Tokenisation: common questions

Is tokenisation the same as encryption?

No. Encryption transforms data reversibly, so anyone with the key can recover the original. A token is a reference with no recoverable relationship to the underlying value; the mapping exists only inside the provider's vault, which is why a stolen token is close to worthless on its own.

Does tokenisation reduce PCI DSS scope?

The effect depends on the payment-provider integration and which systems handle cardholder data. Review the provider's integration documentation to understand where payment details are entered and processed.

What happens to tokens if we switch payment provider?

Gateway tokens are generally valid only with the provider that issued them, so switching requires a token migration. Network tokens, issued by the card scheme rather than the provider, are more portable and also update automatically when a card is reissued.

Go deeper: How Finero handles payment data.

How this connects to other terms

ACH / Bacs / SEPA
Bank rails avoid card data entirely, an alternative route to the same reduction in scope.

Tokenisation