Tokenisation replaces card details with a unique identifier that is useless to a fraudster on its own. The merchant stores the token rather than the card number and uses it for repeat charges: subscriptions, one-click payments, plan renewals.
How it works
- The buyer pays for the first time and agrees to save the payment method.
- The provider stores the card on its side and returns a token to the store.
- For the next charge the store sends the token, not the card details.
- The card itself stays inside the provider's secure perimeter.
What it gives you
- Security. Even if the store's database leaks, nobody can pay with a token.
- Compliance. The merchant never stores card data, and so avoids the full weight of PCI DSS requirements.
- Convenience. A repeat purchase takes one click, with nothing to type.
Worth remembering
A token is tied to a specific card: when it is reissued, charges stop going through. That is one of the classic reasons subscriptions lapse — plan a retry and a notification to the customer.
And separately: consent to save a card must be explicit, and cancelling must not require contacting support.
