What is Tokenisation? Your Definitive 2024 Guide
A comprehensive guide to tokenisation technology and how it could drastically benefit your organisation
Today the safeguarding of sensitive information has become a top priority due to the prevalence of data breaches and identity theft. One groundbreaking solution that has emerged is tokenisation.
Tokenisation has revolutionized the way we handle and secure sensitive data, particularly in the area of payment technology. In this comprehensive guide, we will explore the meaning of tokenisation, its significance in various industries, its key principles and benefits, and how it works to safeguard sensitive information.
What is Tokenisation?
Tokenisation is a robust data security technique that replaces sensitive information, such as credit card numbers, with unique identifiers called “tokens”. These tokens act as substitutes for the original data, rendering them useless to unauthorized users.
This process allows sensitive data to be stored securely in a separate system, while the token itself is used for transactions and interactions.
By employing specific methods and algorithms, tokenisation ensures that reversing the tokens into the original data becomes practically impossible without access to the tokenisation system. Customers can securely save their credit card details, making future payments a lot quicker and better protected from a potential data breach.
The Origin of Tokenisation
The concept of tokenisation was created in 2001 by a company called TrustCommerce for their client, Classmates.com, which needed to significantly reduce the risks involved with storing cardholder data. From this, TC Citadel was developed, allowing customers to reference a token in place of their sensitive card data.
TrustCommerce then processed the payment on the merchant’s behalf. Instead of storing data, tokenisation replaces the primary account number (PAN) with randomly generated symbols that would be useless if intercepted by hackers. This ingenious approach rendered the tokens meaningless to hackers, ensuring heightened data security.
Over time, major debit and credit card issuers recognised the value of tokenisation, incorporating it into the standard online shopping experience. Today, tokenisation stands as a cornerstone of data protection and payment security, transforming how businesses safeguard sensitive information in the digital landscape.
Tokenisation in Payment Processing
One of the most prominent areas where tokenisation has had a significant impact is payment technology. Traditional payment systems often store sensitive cardholder data, making them lucrative targets for hackers.
Tokenisation addresses this vulnerability by substituting primary account numbers (PAN) or other payment-related data with randomly generated tokens. These tokens can be used for transactional purposes without revealing the original card data, significantly reducing the risk of fraud and data compromise.
It increases convenience and saves valuable time for the customer, as they don’t have to re-enter their card details on future or repeated payments. For organisations, the purchasing time and the number of abandoned sales can be drastically reduced as the customer doesn’t need to have the card ready at hand at the checkout stage.
The option to tokenise can be offered to customers a number of ways, including on the phone, online or over SMS. When a customer complete a payment with their debit or credit card, they can be given the option to “save” their card details for future use.
Did You Know?
A survey by the Payment Card Industry Security Standards Council (PCI SSC) found that tokenisation can help reduce the cost of compliance by 55%. *Source: PCI Security Standards Council – Tokenisation Guidelines.
How Tokenisation Works
The tokenisation process is a highly effective method for securing sensitive data, as the tokens generated hold no intrinsic value and cannot be mathematically reversed to reveal the original information. By separating sensitive data from systems and applications, tokenisation significantly reduces the risk of data breaches and minimizes compliance requirements.
To ensure the protection and usability of data, the tokenisation process follows these main steps:
1. Data Discovery
Before tokenisation, sensitive data is identified and categorized,
including credit card numbers, social security numbers,
or personal identification information.
2. Token Generation
Unique tokens are generated for each data element using various algorithms and encryption techniques. These tokens are designed to be non-reversible, ensuring the original data remains secure.
3. Token Storage
The generated tokens, along with associated non-sensitive data, are securely stored in a separate database called a token vault. Strict access controls and encryption are implemented to protect the token vault from unauthorized access.
4. Mapping Between Tokens and Original Data
A mapping or lookup table is created to associate each token with its corresponding original data. This table allows authorized users to retrieve the original data by referencing the token. Importantly, the mapping table itself does not contain any sensitive information.
5. Secure Tokenisation Infrastructure
Tokenisation systems employ robust encryption algorithms and security measures to safeguard both the tokens and the mapping table. Encryption ensures that even if unauthorized access to the token vault occurs, the tokens remain unreadable without the encryption keys.
By implementing these steps, organisations can achieve robust data protection, enhance security, reduce the risk of data breaches, and maintain compliance with regulatory requirements.
The benefits of Tokenisation
Tokenisation stands as a highly effective data security method, ensuring the utmost protection of sensitive information. This revolutionary approach has several benefits for both the organisation and its customers.
For the organisation, it can drastically improve the speed and efficiency of taking payments. Because the card payment is out of scope and not stored within the business’s systems, there is much less impact from a data breach or loss of data. The key goal is to reduce any risks involved in taking payments, especially after the increased fines and penalties incurred in a data breach following the introduction of GDPR. Instead of encrypted data and decryption keys being stored in the businesses’ systems, hackers only have access to harvest tokens with no exploitable value.
Benefits for customers
- Eliminating Repetitive Card Data Entry: They’re not spending unnecessary time typing in all their card data for every purchase.
- Cardless Transactions: They don’t necessarily need a card at hand when making a purchase.
- Error Reduction: There is less chance for mistakes when providing card details again and again.
- Protection of Sensitive Customer Information: They can feel at ease knowing their sensitive card data is never directly interacting with the business they are making the payment to.
- Enhanced Customer Trust: Implementing tokenisation demonstrates a commitment to data security and customer privacy. When customers perceive that their sensitive information is protected by tokenisation, it enhances trust in the organisation.
Benefits for organisations
- Streamlined Checkout: A much quicker payment process for repeated purchases
- Increased Conversion Rates: Less chance of abandoned sales or failed payments
- Flexible Payment Options: The option to provide payment plans to help spread the cost of high-value purchases
- Minimized Risk of Data Breaches: Tokenisation offers robust data security that surpasses traditional data protection methods like encryption. It removes valuable data from the corporate network, reducing the impact if a data breach occurs
- Reduced Scope of PCI DSS Compliance: By tokenising cardholder data, organisations can significantly reduce the scope of their PCI DSS compliance requirements. Tokenised data falls outside the scope of the cardholder data environment (CDE), simplifying the compliance process and minimising associated costs
- Alignment with Data Privacy Regulations: Tokenisation aligns with various data privacy regulations, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Did You Know?
The global tokenisation market size is projected to reach $3.8 billion by 2025, growing at a compound annual growth rate (CAGR) of 22.1%.
*Source: MarketsandMarkets – Tokenisation Market – Global Forecast to 2025
Tokenisation Vs Encryption
Encryption and tokenisation are both considered cryptographic data security methods. Encryption is used when an organisation stores card details within its internal networks and systems. It is very effective at disguising sensitive data, requiring a separate key to ‘unlock’ and decrypt the information for it to be used. Although the risk is reduced, the information is still stored within an organisation’s internal system, and when it is transmitted, the decryption key sometimes has to be embedded.
Encryption offers very little protection if hackers were to gain access to the network and steal both the encrypted sensitive details and the encryption keys. Alternatively, tools can be used in an attempt to decrypt the data without needing a key. Encryption methods have had to continuously evolve over the years to combat this.
Tokenisation is much safer than encryption and is recommended for PCI-DSS compliance. As the data is not stored, disguised, or otherwise, the organisation can be confident that if a data breach were to occur, there is nothing sensitive that can be stolen.
Tokenisation and Regulatory Compliance
1. Compliance with GDPR
The GDPR imposes stringent obligations on organisations that handle the personal data of individuals within the European Union (EU). Tokenization serves as a valuable tool for achieving GDPR compliance by pseudonymizing personal data. Through the substitution of identifiable information with tokens, organisations can mitigate the risk of unauthorised access to personal data, significantly reducing the likelihood of non-compliance with GDPR provisions.
2. HIPAA Compliance
3. PCI DSS Compliance
The Evolution of Tokenisation
Tokenisation has continually evolved to meet the changing needs of data security and privacy. As technology advances, new trends and innovations in tokenisation have emerged. One such advancement is sector-specific tokenisation, where tokens are generated and utilized uniquely for each specific sector or industry. This approach enhances data protection by further minimising the linkability of information across databases. By employing sector-specific tokenisation, organisations can effectively compartmentalise data and restrict access to sensitive information, reducing the risk of unauthorised data correlation and privacy breaches.
Another notable development in tokenisation is the concept of revocable tokens. Traditional tokens are typically static and remain valid indefinitely. However, revocable tokens introduce an additional layer of control by allowing organisations to revoke or invalidate tokens when necessary. This capability enhances data security, especially when tokens may have been compromised or individuals need greater control over their personal information. Revocable tokens give organisations and individuals greater flexibility and control over data access and minimize the risk of unauthorised token usage.
Furthermore, the integration of tokenisation with other security measures has shown promising results. Organisations can establish comprehensive and layered security frameworks by combining tokenisation with encryption techniques or multi-factor authentication. These integrated approaches create a robust defense against data breaches and ensure that even if one layer of security is compromised, sensitive data remains protected by tokenisation.
The Real Use Cases
Tokenisation has gained prominence across various industries, including retail, finance, healthcare, and the government sector. Its adoption stems from the pressing need to protect sensitive information and mitigate the risks associated with data breaches.
Dermalogica UK, a prominent skincare brand, sought to enhance payment security for their business clients using a contact center. Key IVR provided a solution by implementing an Agent Assisted Payment system, making payment management easier and safer. The solution involved secure telephone payments, complying with PCI-DSS Level 1, and tokenising payment cards for efficient processing. The successful collaboration resulted in improved security measures and a streamlined payment process, fostering a positive long-term partnership between Dermalogica and Key IVR.
“Over the past three years, Dermalogica has built up a good working relationship with the management and sales team at Key IVR and will be shortly working together on other exciting projects. Since introducing the platform into our contact centers, managing payments has been made easier and safer for our consumers.”
—————
Gemma Evans
Accounts Receivable/PCI DSS Complia
Tokenisation with Recurring Payment Plans
This method of tokenisation also allows for an organisation to offer a recurring payment plan, a perfect way for customers to spread the cost of a purchase over time. A range of payment frequencies is available, such as weekly, fortnightly, monthly, and more.
If required, a Recurring Plan/Continuous Payment Authority (CPA) can be created by processing £1 that will not be taken from the customer’s account. This ‘Promise to Pay’ method uses a Recurring Payment Plan instead of a Direct Debit and allows organisations to re-take failed payments, restarting the plan and avoiding customers incurring expensive failed Direct Debit charges. This method is recommended by the Financial Conduct Authority (FCA), as debt isn’t added to the outstanding amount the customer is paying off.
These options can be offered by an Agent on the phone with a customer or through a secure Web Payment service.
Did You Know?
Estimates on the impact of tokenisation in financial markets vary, but there is a growing consensus that it could be transformative.
*Source: UK Finance – Unlocking The Power of Securities Tokenisation
Conclusion
Tokenisation has emerged as a powerful solution for securing sensitive data and enhancing privacy in the digital era. Its widespread adoption in various industries, particularly in payment technology and identification systems, demonstrates its effectiveness in mitigating the risks of data breaches and unauthorized access. By replacing sensitive information with non-sensitive tokens, organisations can safeguard personal data while facilitating secure transactions and efficient identification processes.
With a payment service from Key IVR, an organisation can tokenise a customer’s card so that they will only have to provide card details once, saving them time on regular payments and purchases. This can be done over the phone with an agent, online, or via SMS. Card details are tokenised securely in a PCI-DSS Level 1 environment and not stored anywhere outside the issuing card company. All tokens have a dedicated reference for every individual customer. E.g. Policy number, customer number, customer name, phone number, etc.
For more details, contact Key IVR, on the phone 01302 513 000 or email sales@keyivr.com, and we can discuss how tokenisation can save your customers valuable time and improve your payment methods across a wide range of services.
FAQ - Your Questions Answered
What is tokenisation?
Tokenisation is a data security process that replaces sensitive information with unique identification symbols known as tokens. The tokens hold no exploitable value and can be safely stored by an organisation. This process reduces the risk of data breaches and increases convenience, saving time for customers as they don’t have to re-enter their card details on future or repeated payments.
How does tokenisation work?
Tokenisation works by replacing sensitive data with unique tokens. When a transaction or request occurs, these tokens are used instead of the original data. The tokenisation system securely links the tokens to the actual data, allowing authorized access when needed. This process enhances security by preventing the exposure of sensitive information, making it a key technology for safeguarding data during transactions and storage.
What is a tokenisation example?
An example of tokenisation is when a customer opts in to save their credit card details with an organisation. Often as part of an online checkout or asked by an agent over the phone.
Instead of storing the actual credit card details in the organisation’s systems, the sensitive information is replaced with a non-sensitive equivalent known as a token. This token is a unique identification symbol that holds no exploitable value and can be safely stored by the organisation.
For instance, if a card number was 1234 5678 8765 4321, it would end up looking something like H42YU2QQ98A.
The next time the customer makes a purchase, they can select a saved card, which uses the token instead of re-entering their credit card details. This saves them time and reduces the risk of data breaches.
Are tokens secure?
The tokens are very secure as they are managed by the major card companies that issue the debit or credit cards. However, the storage of tokens and payment card data must comply with the Payment Card Industry Data Security Standards (PCI DSS), including the use of strong point-to-point encryption. By working with a third-party payment solutions provider such as Key IVR, our diverse integration capabilities allow for the tokenisation process to be done safely and securely across a range of payment methods.
Is tokenisation the same as NFT (Non-Fungible Token)?
No, tokenisation is not the same as NFT (Non-Fungible Token).
Tokenisation refers to the process of breaking down a larger piece of data into smaller units called tokens. These tokens are then used as individual units of data that can be analysed, processed, and stored more efficiently.
On the other hand, NFTs are a type of digital asset that represents ownership, or proof of authenticity, of a unique item or piece of content, such as artwork or collectibles, on a blockchain network.
How many types of tokenisation are there?
There are two main types of tokenisation in the payment industry:
Card-based tokenisation: This type of tokenisation replaces sensitive payment card data, such as the card number and expiration date, with a unique token. This token is then used for payment processing, and the original card data is stored securely by the payment processor.
Network-based tokenisation: This type of tokenisation replaces sensitive payment data with a token at the network level, rather than at the card level. This means that the token is generated and managed by the payment network, rather than by the card issuer or payment processor. Network-based tokenisation is typically used for mobile payments, where the token is stored on a mobile device and used to make payments.
How do I tokenise my card?
What is the difference between crypto and tokenisation?
Cryptocurrencies and tokenisation are two different concepts in the world of finance and technology.
Cryptocurrencies are digital currencies that use encryption techniques to secure transactions and to control the creation of new units. Cryptocurrencies operate independently of a central bank or government.
Tokenisation is the process of converting an asset into a digital token.
Are digital wallets tokenised?
What is the benefit of tokenisation?
The biggest advantage of tokenisation is that it can greatly reduce the risks and impact of a data breach or loss of sensitive data for both organisations and their customers.
By replacing actual card data with tokens, hackers or unauthorised users are not able to access sensitive card information, which helps to increase the security and protection of customer data.
Tokenisation also offers benefits such as a quicker payment process for repeated purchases, less chance of abandoned sales or failed payments, and the option to provide payment plans to customers for high-value purchases.
Find out more about Tokenisation
Talk to us about the many options available in reducing the number of chargebacks impacting your organisation.
Submit your details and a payment specialist will be in touch.
Mark Kelly
Chief Commercial Officer (CCO) (UK) & VP International Sales (US)