← Payment Reference GuidesSecurity Reference
Payment Tokenization
How real card numbers (FPAN) are replaced by tokens (DPAN) for digital wallets, card-on-file, and IoT payments. Covers the full lifecycle, cryptogram generation, and the Visa VTS vs. Mastercard MDES service comparison.
Token Service Providers
Each major card network operates its own Token Service Provider. While they implement the same EMVCo Payment Tokenization Specification, each has distinct BIN ranges, form factor support, and API interfaces.
| Attribute | Visa VTS | Mastercard MDES | Amex AETS |
|---|---|---|---|
| Full Name | Visa Token Service | Mastercard Digital Enablement Service | American Express Token Service |
| Operator | Visa Inc. | Mastercard International | American Express |
| Token BIN Range | Visa-assigned BINs (typically 4xxx series) | Mastercard-assigned BINs (typically 5xxx or 2xxx) | Amex-assigned token ranges (34 / 37 series) |
| Form Factors | Mobile wallet, wearable, card-on-file, IoT, browser | Mobile wallet, wearable, card-on-file, IoT, browser | Mobile wallet, card-on-file, selected wearables |
| Provisioning Methods | Push (issuer) + Pull (consumer OTP) | Push (issuer) + Pull (consumer OTP) | Push (issuer) + Pull (OTP / CVC validation) |
| Cryptogram Type | TAVV (Token Auth Verification Value) | DSRP (Digital Secure Remote Payment) / ARQC | Token cryptogram from the Purchase Tokens API |
| Production Environment | Visa Token Service (VTS) | MDES Production | AETS production |
| Sandbox / Testing | Visa Developer Platform (developer.visa.com) | MDES Sandbox (developer.mastercard.com) | Amex Developer (developer.americanexpress.com) |
| Lifecycle API | VTS issuer and token requestor APIs | MDES Customer Service and Digital Enablement APIs | AETS Provisionings, Purchase Tokens and lifecycle APIs |
🧩 Check yourself
Can you get a phone tap approved by a bank that has never seen the phone’s card number?
Next steps
ToolToken Format CheckerSee what a token's format does and does not reveal: Luhn, network, valid length, masking limits — card or network token, custom token, or opaque vault ID.Open the tool ToolCustom Token GeneratorMake proprietary payment tokens without the card networks: vault tokens, vaultless FF1 format-preserving encryption or keyed hashes. Keep the BIN and last four, force a Luhn failure, and detokenize.Open the tool ToolWallet Provisioning InspectorIdentify and check push-provisioning payloads for Apple Pay and Google Wallet: PKAddPaymentPassRequest, Mastercard IIDD / Opaque Payment Card, push account receipts, Visa JWE fields, Google UAPP (OpenPGP) and app-to-app ID&V.Open the tool FlowNetwork token lifecycleSee the animated message flow, step by step, between every party involved.Watch the flow
Related articles
Authentication3D Secure (EMV 3DS)Authentication flows, message types, ECI values, SCA exemptionsRead article Card RailsISO 8583 ProtocolMessage structure, bitmap mechanics, 128 data elements, network variationsRead article ContactlessNFC in PaymentsHow a contactless tap works end to end — from RF layer to cryptogramRead article IdentityEUDI Wallet & PaymentseIDAS 2.0 deadlines, the SD-JWT VC / mdoc / OID4VP stack, wallet-based PSD2 SCARead article