Tokenizzazione di rete: cos’è e perché è importante

Network tokenization replaces a customer’s real card number with a secure, dynamic token issued by the card network itself. It does two things at once. It cuts fraud, because a stolen token is close to worthless outside the place it was issued for. And it raises the share of legitimate payments that get approved, because issuing banks trust tokenized transactions more than raw card numbers.

That second point is the one most businesses underestimate. Security upgrades usually feel like a cost. Network tokenization is one of the few that tends to show up as recovered revenue.

We see this from the infrastructure side at ConnectPay, where we provide acquisizione delle carte for merchants and platforms. In this guide, we explain what a network token is, how it works, and how it differs from the gateway tokens many businesses already use. We also cover the measured benefits, the effect on PCI compliance, and the practical steps to implement it. If you take card payments online, especially recurring ones, this is worth understanding.

What Is a Network Token?

If you’re asking what is network tokenization, start with the problem it solves. Every card has a primary account number (PAN), the long number printed on the front. For years, online merchants stored that PAN to charge customers again. That made every merchant database a target, and every breach a source of reusable card numbers.

So, what is a network token? It’s a substitute for the PAN, issued directly by a card network such as Visa or Mastercard through its token service. The token is tied to one specific card and one specific context, usually a particular merchant or the payment provider acting for that merchant. The merchant stores and uses the token. The real card number stays with the network and the issuing bank.

Network tokens have a few properties that make them different from a stored card number.

• They come with dynamic cryptograms. Each transaction carries a one-time code generated for that payment, so the credential can’t simply be replayed.
• They can’t be duplicated or reused across different merchant systems. A token issued for one merchant won’t work for another.
• They’re recognized across the whole acquiring ecosystem. Acquirers, networks and issuers all know what a network token is and how to check it.
• They stay current. A raw card number stored on file goes stale when the card expires or is replaced. A network token stays valid because the network updates it automatically when the underlying card changes. The customer doesn’t have to re-enter anything.

How Network Tokenization Works

Here’s what happens in a typical online purchase when a business uses network tokens.

A customer buys a monthly meal-kit subscription and enters their card details once at checkout. Instead of storing the card number, the merchant’s payment provider sends it to the card network’s token service, Visa Token Service or Mastercard Digital Enablement Service (MDES). The network checks the card with the issuing bank and returns a network token linked to that card and that merchant. From then on, the merchant stores only the network token.

When the next monthly charge is due, the merchant sends the network token plus a fresh cryptogram for that transaction. The network receives it first. It checks that the token was legitimately issued, that it’s being used by the merchant it belongs to, and that the cryptogram is valid. Only then does it translate the token back to the real card number and pass the authorization to the issuing bank.

That sequence explains the security benefit. A network token only works in its authorized context. If an attacker steals a merchant’s token database and tries to use those tokens somewhere else, the network declines them. There’s no card number to reuse, so stolen credentials lose their value.

It also explains the approval benefit. Issuing banks see a transaction the network has already checked, with proof that the credential is genuine and being used where it should be. That’s a stronger signal than a raw PAN, which arrives with no such evidence. So issuers approve more of these transactions, which is the mechanism behind the authorization lift covered below.

Getting this balance right, more security with less friction for genuine customers, is a theme we explore in our piece on sicurezza contro comodità.

Sei pronto a potenziare la tua infrastruttura di pagamento?

Smettila di fare i conti con flussi di pagamento frammentati. Accedi a IBAN dedicati, SEPA Instant e integrazioni API senza soluzione di continuità, il tutto da un’unica piattaforma unificata.

Contatta l'ufficio vendite Scopri i nostri prodotti

Network Tokenization vs. Gateway Tokenization

Many businesses already use tokens and assume they have network tokenization covered. Often, they don’t. There are two different kinds of token.

Gateway tokens, sometimes called PSP tokens, are generated by a payment gateway or processor. When you save a card with your payment provider, it stores the real card number in its own vault and gives you a reference token. That protects your systems, which is useful. But the token only means something inside that provider’s system. The provider still sends the raw card number to the network and the issuer when it processes a payment. And if you switch providers, those tokens don’t come with you.

Payment network tokenization works at a different level. The token is issued by the card network itself, not by your provider. Every party in the chain recognizes it: your provider, the acquirer, the network and the issuer.

That difference matters most for approval rates. The issuer-trust benefit comes from the network validating the token and its cryptogram before the issuer sees the transaction. A gateway token can’t provide that, because by the time the payment reaches the issuer, it’s a plain card number again.

The two aren’t mutually exclusive. Many providers now store network tokens inside their own vaults, so you get both kinds of protection. If you want a refresher on what a gateway actually does, our guide to payment gateway fundamentals covers it.

Benefits of Network Tokenization for Businesses

The benefits of network tokenization for businesses are measurable, and the card networks publish their own numbers.

1. Start with approvals. Visa reports a 4.6% global lift in authorization rates for tokenized card-not-present transactions compared with raw card numbers. Mastercard reports a smaller but still meaningful average uplift of 2.1%. Those percentages sound modest until you apply them to real volume.

Take a subscription business processing €2 million a month in card-not-present payments. A 2% to 4% improvement in approvals means roughly €40,000 to €90,000 a month in payments that would otherwise have been declined. Your results will vary with card mix, geography and how good your setup already is, but the direction is consistent. The lift tends to be most visible on cross-border payments, where issuers are most cautious about merchants they don’t recognize and a pre-validated credential makes the biggest difference.

2. Fraud falls at the same time. Visa reports roughly a 30% reduction in card-not-present fraud for tokenized transactions versus PAN-based ones. Industry surveys point the same way, with over 70% of financial institutions reporting lower fraud after implementing tokenization.

3. False declines drop too, and so does involuntary churn. This is one of the clearest benefits of network tokenization for subscription businesses. When a customer’s card expires or is reissued after a breach, a stored card number fails silently on the next renewal. The customer often doesn’t notice until their service stops. A network token updates automatically, so the renewal goes through.

4. Finally, there’s checkout friction. Visa has cited research showing payment issues can account for up to 44% of digital abandonment. Fewer declines and fewer “please re-enter your card” moments help keep customers in the flow.

The same tokenization principles also sit behind modern card products. Our overview of fornitori di carte virtuali shows how issuers use them.

Network Tokenization and PCI Compliance

PCI DSS, the Payment Card Industry Data Security Standard, applies to any business that stores, processes or transmits card data. The more systems that touch real card numbers, the bigger and more expensive your compliance effort becomes.

Network tokenization helps because it removes the need to keep raw card data in your environment. Once a card is tokenized, your systems store and send the network token, not the PAN. A network token isn’t the card number and can’t be turned back into one by you or by an attacker who steals it. That changes how your systems are assessed.

In practice, this can shrink your PCI compliance scope significantly. Systems that only ever handle tokens, such as your subscription database, billing service or customer support tools, can often be taken out of much of the PCI DSS audit scope. If your payment provider handles the initial card capture through a hosted field or payment page, you may never touch a raw card number at all.

The honest caveat is that tokenization reduces scope. It doesn’t remove the need for a compliance review. You still need to check which systems capture card data at checkout, how your provider handles the tokenization step, and which PCI obligations remain for your business. Your acquirer or a qualified security assessor can confirm where the lines sit for your setup.

We cover the wider picture of obligations in our guide to conformità dei pagamenti.

How to Implement Network Tokenization

Most businesses don’t need to integrate with the card networks directly, and most shouldn’t try. Here’s why, and what the realistic path looks like.

To implement network tokenization yourself, you’d have to register as a token requestor with each network, connect to Visa Token Service and Mastercard MDES separately, handle cryptogram generation, and maintain secure token storage that meets PCI requirements. That’s a large technical and compliance project for a capability that doesn’t differentiate your product.

The more practical route is to partner with a token service provider or payment platform that already has those network relationships. It requests tokens on your behalf, stores them securely, generates cryptograms for each payment, and manages the network connections.

Token lifecycle management is the main reason to choose an established provider. Cards expire, get replaced after fraud, or are upgraded by the bank. Each event needs to flow through to the right token so the next charge succeeds. A provider with mature lifecycle handling keeps credentials valid automatically. A home-built setup that misses those updates loses much of the benefit.

Expect a phased rollout rather than a single switch. Most providers start by tokenizing new cards at checkout, then migrate your existing stored cards in the background. Track approval rates and renewal failures before and after, so you can see the effect in your own numbers rather than relying on network averages.

When you’re adopting network tokenization through a provider, ask four questions:

1. Does it support both Visa and Mastercard tokens?
2. Does it tokenize existing stored cards, not just new ones?
3. How does it handle lifecycle updates?
4. Are tokens portable if you add another acquirer later?

On the issuing side, the same infrastructure makes it possible to put tokenized carte virtuali into employees’ and customers’ hands.

Real-World Examples of Network Tokenization

You’ve almost certainly used network tokenization this week without noticing.

The most common example is a digital wallet. When you add a card to Apple Pay, Google Pay or Samsung Pay, the wallet doesn’t store your card number on the phone or in its systems for payments. Instead, it asks the card network for a network token linked to your card and your device. Apple calls this a device account number. When you tap your phone at a till or pay in an app, the wallet sends that token and a one-time cryptogram, not your real card number. If you lose the phone, your bank can suspend that one token without cancelling your physical card.

Card-on-file merchants are the second common case. Streaming services, ride-hailing apps and online retailers increasingly swap stored card numbers for network tokens behind the scenes, which is why your subscription often keeps working after your bank sends a new card.

The wallet example also explains why digital wallet transactions often see higher approval rates than card numbers typed in by hand. Every wallet payment arrives as a tokenized, cryptogram-backed transaction the issuer can trust. If you’re weighing wallet options for your checkout, our comparison of Google Pay vs. Samsung Pay looks at how they differ.

How ConnectPay Supports Secure Tokenized Payments

Network tokens are issued by the card networks, not by ConnectPay. What we provide is the infrastructure around them.

Our card acquiring is built to process tokenized transactions, so merchants and platforms can benefit from the higher approval rates and lower fraud exposure covered earlier in this article. On the issuing side, our card programmes run on the same network infrastructure that tokenization depends on, so tokenized transactions on the cards we issue go through the network’s checks before they reach us.

As a licensed EMI, we combine this with the rest of what businesses need to run payments: accounts, IBANs, SEPA and SWIFT transfers, and built-in AML and KYC compliance. For businesses and platforms, that means fewer separate providers to connect and manage.

If you’re comparing how different wallets and payment methods fit around card payments, our guide to the i migliori portafogli digitali è una lettura utile da approfondire.

Turn Card Security Into Higher Approval Rates

Network tokenization is usually filed under security, and it does belong there. But the business case doesn’t rest on risk reduction alone. The authorization lift means tokenization recovers revenue you’re currently losing to false declines and stale card data, often without customers ever knowing there was a problem.

For a subscription business, that shows up as renewals that go through instead of failing quietly. For an online store, it’s fewer customers abandoning checkout after a decline. In both cases, the gain compounds month after month.

For most businesses, the practical path is clear. Building direct network relationships from scratch rarely makes sense. Partnering with a provider whose infrastructure already supports tokenized transactions gets you the benefits faster, with lifecycle management handled for you.

If you’re reviewing your card setup, start by checking whether your stored cards are network tokens or gateway tokens. Then talk to ConnectPay about where tokenization fits in your payments stack.