Short answer

Tokenization replaces a card number with a surrogate value called a token. In a vault-based system the token has no mathematical link to the original card number. A cryptogram, not a CVV, authorizes the transaction. Network tokens follow the EMVCo Payment Tokenisation Specification. Vaultless systems use format-preserving encryption instead of a lookup table.

CVV Tokenization Tool Guide: Where to Buy CVV

What a CVV is

A CVV is a 3-digit or 4-digit value the issuer computes from the card number, an expiration date, and a secret key. Visa prints CVV2 on the card. Mastercard calls it CVC2. American Express calls it CID. Discover calls it CID. Card brands hold two issuer keys: one for magnetic stripe data and one for the printed value.

read more

Card networks classify the CVV as sensitive authentication data. PCI DSS Requirement 3.2 forbids storage of sensitive authentication data after authorization. That rule covers the printed value, full track data, and PIN blocks. A merchant that keeps CVVs in a database fails the assessment.

tokenization cvv process

Vault-based tokenization

A token service provider operates a vault. The vault maps each token to one PAN. The steps:

tokenization cvv test

1. The merchant sends the PAN to the token service provider at card capture.
2. The provider generates a token. Common methods include a random number inside an assigned BIN range, an HMAC counter, or a sequence number mapped to the PAN.
3. The provider computes the Luhn mod 10 check digit so the token passes routing validation.
4. The merchant stores the token. The PAN stays in the vault, which sits inside a segmented network.

Token length matches PAN length: 13 to 19 digits. The first six digits fall in a token BIN range the card network assigned to the provider, so authorization messages route to the correct vault.

Format-preserving encryption

Vaultless tokenization encrypts the PAN with a block cipher that keeps the digit format. NIST SP 800-38G specifies two modes: FF1 and FF3-1. Both use AES as the underlying primitive. The output is a number with the same length and character set as the input.

The tradeoff: no vault to breach, but the encryption key is the single point of failure. Key rotation, hardware security modules, and split knowledge controls carry the security load.

Network tokens and cryptograms

EMVCo published the Payment Tokenisation Specification. A token requestor enrolls with a token service provider. The provider issues a DPAN, also called a digital PAN, and assigns a token assurance level. The cryptogram takes the role of the CVV as the dynamic check.

For a chip or device transaction, the token requestor derives a cryptogram from transaction data, an application transaction counter, and a key held in secure hardware. The issuer validates the cryptogram before approval. A stolen DPAN alone fails without that key.

Dynamic CVV works on the same principle at a smaller scale. The chip on some cards generates a fresh 3-digit code for each use, and the code expires.

Limits

Tokenization does not stop all fraud. Account enumeration, token provisioning fraud, and issuer-side compromise remain. The PCI Security Standards Council states that tokenization can reduce PCI DSS scope, but only when the token service provider keeps card data out of the merchant environment. Scope reduction is not automatic.