TL;DR

Network tokens replace a 16-digit card number with an issuer-linked token that auto-updates when a card is reissued. Visa reports a 4.8% increase in authorization rates for tokenized card-not-present transactions versus card numbers, based on its 2025 network data; your own lift will differ. This guide covers the fees, contract traps, and operator wins. Visa figures checked Nov 2026.

What this actually is

Two unrelated things both get called tokenization, and the difference matters for approval rates.

The first is processor vault tokenization. Your gateway or processor takes the customer's primary account number, stores it in a PCI-compliant vault, and hands you back a random string. Every charge you submit references that string. The PAN never touches your servers. This is a security control. It does nothing for approval rates because the processor still submits the raw PAN to the network at authorization time.

The second is network tokenization. Visa Token Service (VTS) and Mastercard Digital Enablement Service (MDES) sit between the processor and the issuer. The network requests a token from the issuing bank, the issuer returns a domain-restricted token bound to your merchant ID, and every authorization carries a one-time cryptogram in addition to the token.

The lift comes from two mechanisms. Issuers can treat network tokens as higher-trust because the cryptogram shows the request came from an authorized token requestor. And when a card is lost, stolen, or expires, Visa says tokenization lets the issuer update the credential automatically, with no action from the customer. The merchant does not need the new number or a new card from the customer, so far fewer charges fail on reason code 54 (expired card).

Operator noteVault tokens protect data. Network tokens lift approval rates. If your processor sells you "tokenization" without mentioning Visa Token Service or MDES, you are buying the security version, not the authorization version.

Network tokenization replaces a cardholder's 16-digit account number with an issuer-linked token that updates automatically when the card is reissued, raising authorization approval rates.

How it works under the hood

The token lifecycle has three phases: provisioning, transacting, and updating. Each phase involves a different counterparty and a different message format.

  1. Provisioning request. Your processor sends the PAN, expiration date, and your Token Requestor ID to Visa or Mastercard. This usually happens the first time a customer's card is charged, or when you migrate an existing vault in bulk.
  2. Issuer check. The network forwards the request to the issuing bank. The issuer confirms the card is in good standing and returns a token (a 16-digit number that resembles a PAN but is not one), a token expiration date, and a Token Assurance Level score reflecting how confident the issuer is in the device or merchant relationship.
  3. Token storage. Your processor stores the token. The original PAN is purged from your vault, or marked as legacy and held only for fallback. Best practice is to delete the PAN once the token activates.
  4. Authorization with cryptogram. On each charge, the processor calls the network and receives a single-use cryptogram bound to that specific transaction. The token and the cryptogram (Visa calls it the Token Authentication Verification Value, or TAVV) go into the authorization request.
  5. Issuer authorization. The issuer's auth system recognizes the token as a stored credential, validates the cryptogram, checks available balance, and approves or declines.
  6. Lifecycle events. If the customer reports the card lost or the card expires, the issuer pushes an update to the network. The next authorization for that token routes against the new PAN automatically. The merchant is not notified and does not need to be.

The published rates sit inside the Visa Interchange Reimbursement Fees schedule and the Mastercard Interchange Rates tables. Visa's schedule effective October 24, 2026 gives CPS-qualified consumer credit card-not-present transactions an incentive of 0.05 percentage points for an EMV token, 0.10 points for its Digital Commerce Authentication Program, and 0.15 points for both, except Charity 1 and CPS/Utility. Debit categories show no such incentive.

Two operator-relevant details: the token is restricted to the requesting merchant's domain, so a token issued for Merchant A cannot be replayed at Merchant B. And the cryptogram is single-use, so a stolen token without a fresh cryptogram is worthless.

Where it goes wrong for operators

Four patterns show up across statement reviews.

Pattern 1: Per-token fees that erase the lift. Some processors charge per token provisioning call or per cryptogram request. Run the math on your own volume: for example, a 1 cent fee on 50,000 token transactions a month is $500 a month. If your lift is small and your tickets are low, the math gets close. Negotiate token provisioning into the gateway monthly fee, or push for $0 per cryptogram.

Pattern 2: Vault token sold as network token. Sales reps conflate the two. The contract says "tokenization included," but the technical documentation only references the processor's PCI vault. Ask in writing whether the processor is a registered Token Requestor with Visa and Mastercard. The list of registered TRs is internal to the networks but any processor that participates will confirm in writing.

Pattern 3: Tokens that do not port. Network tokens are bound to a Token Requestor ID. If you switch processors and your old processor is the TR of record, the tokens die. Some processors agree to a token portability clause; others refuse outright.

Pattern 4: Subscription billing without cryptogram. If your recurring billing engine still sends the original card number, or sends the token without the fields the network expects, the issuer may treat it as an ordinary card-on-file transaction. The lift evaporates. This can happen when the recurring engine was built before network tokens and nobody updated the integration. Pull a sample of 50 subscription charges and confirm with your processor that each went out with the network token.

Watch outProcessors price network token services differently. Some bundle them, some charge per call. Get the per-token and per-cryptogram fee in writing before signing.

Most merchants assume tokenization is a single switch. It is not. It is a multi-counterparty integration with four points where it can silently fail.

Worked example with real numbers

Consider a B2C subscription box merchant:

  • Vertical: monthly subscription, physical goods
  • Monthly volume: $800,000
  • Average ticket: $89
  • Monthly transactions: roughly 8,989
  • Current authorization rate: 88.4 percent
  • Card-on-file ratio: 92 percent of attempted charges
  • Current processor: flat-rate, 2.9 percent plus 30 cents

Decline reason analysis from the past 90 days:

  • Reason 05 (do not honor): 4.2 percent of attempts
  • Reason 14 (invalid card number): 1.8 percent
  • Reason 54 (expired card): 3.1 percent
  • Reason 51 (insufficient funds): 1.4 percent
  • Other: 1.1 percent

Reason 54 is the cleanest win. With network tokens, the issuer can update the card behind the token on reissue. That 3.1 percent of attempts is about 279 transactions at $89, or $24,830 in monthly volume.

Reason 05 is partly recoverable. For this example, assume tokens lift approvals on borderline 05 declines by 1.3 percentage points, or roughly 117 transactions and $10,413 in monthly volume. That is an assumption, not a Visa figure.

Illustrative exampleAssume the post-migration authorization rate lands at 91.8 to 92.5 percent, a lift of 3.4 to 4.1 points. At $800K monthly volume, that recovers $27,200 to $32,800 in gross volume per month, or $326,400 to $393,600 annualized. After the 2.9 percent plus 30 cent processing cost on those sales, about $26,300 to $31,700 a month stays with the merchant before cost of goods. Ask your processor what it charges for tokens at this volume and subtract it.

One detail: this calculation assumes the recurring engine actually sends the network token. If the migration was never finished, the auth message still goes out with the card number. Check a sample of authorizations with your processor before celebrating.

Your own reason-54 rate depends on how long customers stay and how often their banks reissue cards. Network tokens are built to recover much of it.

Operator playbook

Seven actions to take this week.

  1. Pull a 90-day authorization report. Group declines by reason code. Focus on 54 (expired card) and 14 (invalid account number) on stored cards, which token updates target, plus 05. Insufficient-funds declines (51) are not a token problem. Compare the size of that bucket with your token fees.
  2. Confirm Token Requestor status in writing. Email your processor: are you a registered Token Requestor with Visa Token Service and Mastercard MDES, and can you provision and store network tokens for our merchant ID? If the answer is yes, ask for the TR ID. If the answer hedges, you are looking at vault tokens, not network tokens.
  3. Get the fee schedule in writing. Request line items for: token provisioning fee, per-cryptogram fee, monthly token storage fee, and lifecycle update fee. Push all four toward zero.
  4. Demand a token portability clause. If you switch processors, can the existing tokens transfer to the new TR? Ask whether tokens can move to a new token requestor and get a written commitment to cooperate before signing.
  5. Audit a sample auth message. Ask your processor to pull the raw ISO 8583 messages for 20 random subscription charges. Confirm the token, not the original card number, is in the request, and that customer-initiated token charges carry the cryptogram. This is the single highest-value sanity check.
  6. Run a 30-day A/B test if you can. Some integrations let you route a percentage of card-on-file traffic through network tokens and compare. Visa's reported 4.8% figure is a network-wide average, so use it only as a loose reference. A lift near zero suggests a configuration problem.
  7. Recalculate interchange. On Visa, CPS-qualified consumer credit card-not-present transactions with an EMV token get a 0.05 percentage point incentive, or 0.15 points with Visa's Digital Commerce Authentication Program too. Pull last month's statement, find the CNP rows, and confirm tokenized volume is getting the incentive.
The lift only shows up if the token actually reaches the issuer. Check the authorization message, not the contract.