In the previous module, I talked about the future of card payments,
and that's a strange future actually where the physical
card in a card payment no longer exists.
You may have already experienced this yourself if you've loaded your card into
a smartphone or a watch and then used that for payments.
There's some clever technology behind how this works that's designed to
keep your real card data hidden from the device you use.
And that's because devices are changed frequently and
can be easier to lose or have stolen.
And it also takes the real payment card data out of
most of the payment ecosystem.
So the aim of the card industry when these systems were designed was
to make sure there was a deliberate disconnection between the device
and the cardholder's actual account.
And here's how that was designed.
When you go to add a payment card to a device,
there's a conversation between the device and the card issuer.
Just as with an authorization,
the card issuer really wants to make sure it's their customer
who's trying to add their card to the device.
Once the issue is satisfied it really is their customer,
they use a token service to generate a brand new PAN,
which is sent back to and stored on the device.
So it's not the customer's real PAN that's stored on the device.
It's this brand new PAN that's stored on the device,
and this PAN is called an EMV‑Token.
And the great thing is that it can only be used by that device.
So somehow if a criminal got hold of the PAN and
tried to use it in any other way, the transaction will be rejected by the issuer.
When the cardholder makes a transaction using the device,
the merchant and the acquirer just see the token,
that new PAN, as it's passed to the card scheme and then to the issuer.
And then somewhere, either in the card scheme or at the issuer,
the token is swapped for the customer's real PAN,
which is also known as the funding PAN.
The transaction is then processed as normal.
This model of swapping the token for the funding PAN in the process
of authorization made it easy for these new payment devices to be
adopted by every issuer because it didn't require any changes to
their authorization systems.
Practically, when these tokenization systems were first released,
the tokens were generated and replaced by card schemes
themselves on behalf of the issuers,
although now there are a number of other companies
that can provide this service.
A company that does this job of turning PANs into tokens and then tokens
back into PANs is known as a Token Service Provider,
or TSP.
If you've used your mobile phone as a payment device,
you might have wondered why it usually doesn't have a PIN associated with
it and that you can pay for even quite high‑value transactions without
needing to enter a PIN on the payment terminal.
The reason is that the device itself is able to prove to the
issuer that it's being used by the real cardholder.
And that could be because the user has had to type in an
unlock code or they've used a device biometric,
like their fingerprint or facial recognition.
So the device is really sure that it's the cardholder that's
using it and can tell or even promise to the issuer that
it's the cardholder doing that.