Demystifying network tokens: how do they improve payment performance?

One of the most common causes of failed recurring payments is a card that expires or gets reissued without the customer updating their details. The stored card details simply went stale, and the next charge failed. The customer never cancelled their purchase, but you lost them anyway. 

Network tokens solve this by replacing the raw card number with a secure credential issued by the card network itself (Visa or Mastercard). That credential updates automatically when a card is reissued, sends a stronger trust signal to issuers, and keeps card details hidden throughout the payment chain. The result is higher authorization rates, lower fraud, reduced interchange fees, and fewer customers lost to expired cards.

This guide covers what network tokens are, how they work, and how to implement them without locking your business into a single processor.

Primer is a unified payment infrastructure that requests and stores network tokens independently of any single processor. Book a demo to see how it works for your payment stack.

What is a network token?

A network token is a secure replacement for the long card number, called the primary account number (PAN), on a customer's card. It is issued by the card network itself, either Visa or Mastercard, and is unique to the combination of that card, that merchant, and that payment provider.

When a customer saves their card on a merchant's site, instead of storing and transmitting the raw card number with each payment, a network token is used in its place. The raw card details are never exposed to the merchant's systems or the processor during the transaction.

This is different from a payment gateway token, sometimes called a PCI token, where the gateway stores the card details and gives the merchant a reference to them. With a gateway token, the raw card number is still revealed to the processor during processing. With a network token, the card number stays hidden throughout the entire transaction chain.

How network tokenization works

The process behind network tokenization is straightforward, even though the technology is sophisticated. Here is what happens step by step:

1. The customer enters their card details at checkout, including card number, expiry, and CVV.
2. The merchant's payment provider sends the card details to the card network (Visa or Mastercard) and requests a network token.
3. The card network creates a unique token for that card-merchant combination and shares it with the customer's issuing bank.
4. The token is returned to the payment provider, who stores it for future use.
5. On every future transaction, the network token is used instead of the raw card number. A one-time cryptogram is generated for each payment, adding an extra layer of security.
6. If the customer's card expires or is reissued, the card network automatically updates the token with the new card details. No customer action is required.

How network tokens improve payment performance

Network tokens deliver measurable improvements across key areas that can impact your bottom line, including authorization rates, fraud reduction, customer experience, and processing costs.

Increase authorization rates by giving issuers more confidence in the transaction

Network tokens help close the gap between card-not-present (CNP) authorization rates and in-person transactions by providing issuers with stronger trust signals alongside each payment. 

Visa reports a 4.6 percentage point lift in authorization globally for tokenized CNP transactions compared to PAN-based. Mastercard's benchmark shows a 3 to 6 percentage point improvement on average for CNP first-attempt transactions. At volume, even a 2% percentage point improvement translates into significant recovered revenue per billing cycle.

Reduce fraud by keeping card details hidden throughout the payment chain

Network tokens enhance the security of card-not-present transactions through several built-in mechanisms. The PAN is concealed throughout the entire transaction lifecycle, so raw card details are never exposed. Each token is uniquely linked to a specific customer and merchant pairing, making it unusable for transactions at other merchants, unlike a compromised PAN.

The payment provider also generates a one-time cryptogram for each customer-initiated payment using a saved card. This cryptogram substitutes for the CVV and expires immediately after use. Even if a token is intercepted, it cannot be reused because the cryptogram is single-use and tied to that specific transaction. 

As fraud becomes more common, false declines can happen even for valid purchases. Unsurprisingly, Mastercard found that network tokens resulted in a 5-6% decrease in false declines. 

Keep card credentials current automatically and reduce checkout friction

While authorization rates and fraud reduction are significant advantages, network tokens also have a meaningful impact on the customer experience.

Network tokens include a built-in lifecycle management mechanism that keeps a customer's card credentials current. When a card-on-file is reissued or expires, the card network updates the token automatically. The customer never needs to log in and update their details, eliminating a friction point that causes drop-offs in both one-time purchases and recurring payments.

For subscription merchants, this is particularly valuable. Failed renewals caused by expired or reissued cards are one of the leading drivers of involuntary churn. Network tokens address this at the infrastructure level, keeping the stored credential valid regardless of what happens to the physical card.

Lower interchange fees on tokenized transactions

Card schemes like Visa and Mastercard often offer merchants reduced interchange fees for transactions processed using network tokens. The networks actively incentivise adoption because tokenized transactions carry lower fraud risk and higher approval rates, which benefits the entire ecosystem. For merchants processing significant volume, the fee reduction compounds into measurable savings over time.

When should merchants start using network tokens?

Network tokens become valuable as soon as saved cards contribute to recurring revenue, which is often the case if your business has recurring payments, subscriptions, memberships, account top-ups, and returning customers who store cards for faster checkout. In all of these cases, every expired or reissued card creates a risk of failed payments and involuntary churn.

They are especially worth prioritizing if:

• Failed renewals are costing you subscription revenue. For example, a card reissued mid-billing cycle fails silently, the customer never sees the email asking them to update, and the subscription lapses.
• Authorization rates are inconsistent across processors, issuers, or markets, and you need a stronger trust signal to improve approval rates on card-not-present transactions.
• You use, or plan to use, multiple processors and need tokens that work across all of them rather than being locked to one provider's environment.
• Fraud is a concern but adding more verification steps would increase checkout friction. Network tokens reduce fraud exposure without changing the customer's experience.

For early-stage merchants processing mostly one-off payments, network tokens may not be urgent. But once repeat payments or multi-processor routing become part of the payment stack, they should be built into the infrastructure from the start rather than retrofitted later.

Network tokens vs account updater

Account updater and network tokens both help merchants reduce failed payments caused by expired or reissued cards, but there are key differences in how they work. 

Account updater refreshes store card details when the underlying PAN, expiry date, or account status changes. It helps keep card-on-file records current. However, you or the processor are still relying on card credentials that ultimately map back to the PAN.

Network tokens go a step further. Instead of updating the stored card number, they replace the card number with a token issued by the card network. That token stays current when the card changes. Each customer-initiated transaction is accompanied by a one-time cryptogram issued by the card network, which acts as proof that the token is being used legitimately. This gives issuers a stronger trust signal during authorization than a raw card number alone.

For merchants, the difference matters because network tokens improve more than card lifecycle management. They can also support higher authorization rates, stronger fraud protection, and lower processing costs.

How network token storage can create processor lock-in

Not all network token implementations deliver the same value. Where the token is requested and stored determines whether it increases a merchant's flexibility or deepens its dependency on a single processor.

If a processor requests the network token on a merchant's behalf, that processor typically becomes the owner of the token. The token may still be processed through another PSP, but the PSP that owns it must initiate the network-token payment. For example, a network token created through Stripe could theoretically be processed through Adyen, but only if Stripe supports initiating the payment through Adyen—a relatively niche capability.

The merchant cannot export a PSP-owned network token into its own systems and use it independently across multiple PSPs. Token ownership also cannot be shared: another PSP may process a payment initiated by the token owner, but it cannot independently initiate payments using that token. In practice, merchants may therefore need to create and maintain a separate network token for each PSP.

This is because a network token is more than a static card number. For customer-initiated transactions, the token owner must generate a transaction-specific cryptogram, similar to a one-time CVV. The owner also receives lifecycle notifications from the card network, such as updates when the token is suspended or deactivated. A PSP that does not own the token cannot generate the cryptogram or independently manage the token’s lifecycle.

This is the same lock-in problem that exists with gateway tokens, just at the network level.

If a platform like Primer requests the token, the token is stored independently and works across all supported PSPs. Primer is not dependent on one PSP’s ability to initiate payments through another, and merchants don’t need to duplicate network tokens for each PSP. This means routing decisions, fallbacks, and recurring payments can all use the same network token regardless of which processor handles the transaction.

How to implement network tokens with Primer

Primer is a unified payment infrastructure that requests and stores network tokens independently of any single processor. This means merchants get the performance and security benefits of network tokens without being locked into one provider.

Store tokens in the Centralized Vault and use them across any processor

When a processor requests a network token on a merchant's behalf, the processor typically retains ownership of the token. Although another PSP may be able to process a payment initiated by the token owner, the merchant cannot export the token, share its ownership, or use it independently across its payment stack

Primer's Centralized Vault stores network tokens independently, so the same token works across supported PSPs, without relying on one PSP to initiate a payment through another. Subscription renewals, repeat purchases, and fallback retries can all route to whichever processor performs best, rather than being constrained by where the card was originally tokenized.

Fall back to PAN automatically when an issuer doesn't support network tokens

Network tokens may not be available or usable for every card, issuer, PSP, or transaction. If a network-token payment cannot be completed, Primer automatically detects this and falls back to processing with the full card details, so the payment goes through without the customer noticing.

Keep card credentials current and reduce involuntary churn

When a card is reissued or expires, the card network updates the network token automatically. Primer stores the updated credentials in the Centralized Vault, making them available across all supported PSPs. 

For subscription merchants, this means fewer failed renewals and less revenue lost to expired cards, without relying on customers to update their details manually.

Measure network token performance in the Network Tokenization Dashboard

Primer's Network Tokenization Dashboard gives merchants complete visibility into how network tokens perform compared to PAN-based transactions. 

You can compare authorization rates, fraud rates, and approval performance across processors, markets, and card networks, so routing and tokenization decisions are based on real data rather than assumptions.

How Zing uses network tokens with Primer to protect recurring revenue

Zing Coach is one of the world's leading AI-powered personal trainer apps, serving a global subscription base. For a subscription business, every failed renewal is a moment where a customer can silently churn. Expired or reissued cards are one of the most common causes.

Zing uses network tokens through Primer to keep stored credentials up to date automatically, ensuring renewals don't fail because a card was reissued or replaced. 

"Primer gives us control," says Elaine Nguyen, Payments Operations Lead at Zing. "We decide which PSP to use per region, currency, or even BIN, and easily experiment to see what delivers the best performance."

Combined with a multi-processor routing strategy built in Workflows and Fallbacks that recover 20% of failed payments, Zing has built a payments stack where network tokens, routing, and automated retries work together to protect recurring revenue.

Get the full value of network tokens without locking yourself into one processor

Network tokens improve authorization rates, reduce fraud, lower interchange fees, and keep card credentials current automatically. The benefits are well documented. The question is how you implement them.

If your processor requests and stores the token, the performance gains are real but the token is locked to that processor. That means recurring payments, routing decisions, and fallback strategies are all tied to one provider. As a result, authorization rates and security improve, but dependency deepens in the process.

Primer requests and stores network tokens independently of any processor. The same token works across every connected provider, so merchants can route payments, retry failures, and optimize subscription renewals without being constrained by where the token was created. And because network tokens sit alongside routing, fallbacks, dynamic 3DS, and unified reporting in one platform, the gains compound rather than operating in isolation.

Book a demo to see how Primer makes network tokens work across your entire payment stack.

Frequently asked questions about network tokens

What happens if a customer's issuing bank doesn't support network tokens yet?

Issuer adoption is growing rapidly but is not yet universal. Visa reports that around 50% of global e-commerce transactions are now tokenized, and Mastercard is targeting 100% e-commerce tokenization by 2030. 

In the meantime, Primer automatically detects when a card issuer doesn't support network tokens and falls back to processing with the full cardholder data, so the payment succeeds regardless.

Should my processor or my payment platform request the network token?

If your processor requests the token, it is tied to that processor's environment and cannot be used with any other provider. If you use multiple processors, or plan to, this creates the same lock-in problem that gateway tokens have. An agnostic platform like Primer requests and stores the token independently, so the same token works across every connected processor for routing, fallbacks, and recurring online payments.

What is the difference between a network token and a gateway token?

A gateway token is created by your processor and is a reference to the card details stored in that processor's system. The raw card number is still exposed to the processor during processing, and the token only works within that processor's environment. A network token is issued by the card network itself (Visa or Mastercard), hides the PAN throughout the entire transaction chain, includes a one-time cryptogram for each payment, and auto-updates when a card is reissued. Network tokens work across processors, offer stronger fraud protection, and often qualify for lower interchange fees.