Tokenisation
Definition
RBI-mandated mechanism that replaces the PAN stored at merchants with a token usable only by that merchant, reducing the value of stolen card-on-file data.
- Regulator
- RBI (India)
- Replaces
- PAN stored at merchant with a merchant-specific token
- Effect
- Reduces value of stolen card-on-file data
- Domain
- Card-not-present and card-on-file payment security
Common questions
Why does tokenisation limit the damage from a merchant data breach?+
A token issued to one merchant cannot be used to make a payment through a different merchant or channel, so if that merchant's systems are breached, the stolen tokens are worthless outside the merchant they were issued to, unlike a stolen card number.
Does tokenisation replace the need for card network fraud monitoring?+
No. Tokenisation reduces the value of stored data to an attacker but does not stop card-present fraud, phishing for OTPs, or fraud committed with the physical card, so it works alongside, not instead of, other fraud controls.
How does tokenisation change a forensic accountant's investigation of a card fraud case?+
Because a compromised token cannot be replayed at another merchant, investigators tracing fraudulent transactions must look for token generation abuse, device binding failures, or merchant-side compromise rather than assuming a single stolen card number explains charges across multiple merchants.
Related terms
- BIN / IIN
- Bank Identification Number, formally the Issuer Identification Number under ISO/IEC 7812. The first six digits of the PAN identify the issuing institution...
- CVV / CVC
- Card Verification Value (Visa) or Card Verification Code (Mastercard). CVV1 is encoded on the magnetic stripe, CVV2/CVC2 is the 3-digit printed code...
- Embossing
- Raised characters on older card fronts produced by an embosser; modern cards are increasingly flat-printed because POS imprinters are obsolete.
- EMV Chip
- Integrated-circuit chip following the EMV (Europay-Mastercard-Visa) specification. Contact interface per ISO/IEC 7816, contactless per ISO/IEC 14443. Generates dynamic cryptograms that defeat static-data...
- Hologram
- Diffractive optical security feature: Visa dove, Mastercard interlocking globes, RuPay tricolour. Hard to reproduce without specialised embossing equipment.
- Magnetic Stripe
- Ferromagnetic strip on the card reverse encoding account data on three tracks per ISO/IEC 7811. Track 1 alphanumeric (79 chars), Track 2...
- NFC
- Near Field Communication, the 13.56 MHz contactless radio interface used for tap-to-pay. Built on ISO/IEC 14443 and underlies UPI Lite and RuPay...
- PVC Card Body
- Standard payment card construction: polyvinyl chloride core sandwiched between two transparent laminated overlays. Card dimensions 85.60 by 53.98 mm per ISO/IEC 7810...
- Shimmer
- Thin sliver-shaped device inserted inside the chip reader of an ATM or POS to intercept data exchanged with the EMV chip.
- Signature Panel
- White panel on the card reverse printed with a tamper-evident background (often the issuer name repeated or the word VOID appearing if...
- Skimmer
- Overlay device fitted on an ATM card slot or POS terminal that reads and stores the magnetic stripe data of cards swiped...