Jump to a Section:
What is Network Tokenization
What is Network Tokenization? Why should I consider using it?
With the growth of credit cards in e-commerce transactions card networks such as Visa and Mastercard now offer Network Tokenization (NT) services that replace raw card numbers (FPAN) with merchant-specific tokens.
Like regular credit card numbers, these Network Tokens (also called DPAN) are a 16 digit value that can be used for completing e-commerce transactions.
Network tokens offer a wide range of benefits for the merchant and consumers:
- Higher Authorization rates
- Reduced fraud
- An improved customer experience through proactive updates from the issuing banks including card art, expiration dates, and last 4.
Are there any metrics for how network tokens are impacting merchant transactions?
- 3.2 average observed authorization life when using tokens.
- 26% fraud reduction (payment volume) for Visa Token transactions compared to PAN based online transactions.
- 69% of U.S. consumers choose to store a card on file (COF) or have recurring % billing set up with their most trusted and frequented merchants3 . Increasingly, these merchants rely on tokenization to enhance security and make their customers’ digital transactions less susceptible to fraud.
What does the word network in ‘Network Tokenization’ signify? Is this somehow related to internet connectivity or network traffic?
The network in Network Tokenization refers to the Payment Networks such as Visa and MasterCard. While network tokens follow a common EMV Payment Token guideline, each of the networks work with their partnering banks to issue network tokens and accept tokens when acquiring payments.
Opt-Into Network Tokenization at Spreedly
How can I opt-into enabling NT for my Spreedly account?
Access to network tokens and network token transactions is part of the Spreedly Revenue Optimization package.
To begin taking advantage of network tokens, please first contact your Spreedly Customer Contact to discuss enabling Revenue Optimization on your Spreedly account.
Can I choose to only enable NT for certain environments?
Yes! NT can be enabled selectively per environment.
What is the fee for enabling / using Network Tokenization?
Revenue Optimization is currently free to Spreedly customers during the Beta period.
I am paying for Account Updater currently. Once I start using NT, do I no longer have to pay for AU?
Currently, we advise keeping Account Updater as part of a well rounded payment solution.
Network Tokens receive proactive life cycle management updates from the issuing banks.
These updates include information about the tokens status, updated card art, and other customer facing information like new expiration dates or Last 4 digits of the original PAN.
Since the network token itself is meant to be the payment method, the full 16 digits of the PAN are not provided in updates.
In a world where network tokens are accepted by all payment processors, PANs are not longer needed.
But the reality is that not all payment processors accept network tokens at this point in time. Therefore, we recommend keeping Account Updater active until all your desired payment processors support NT. At that point you can explore if removing Account Updater and it’s fee is appropriate for your business.
Token Requestor IDs (TRIDS)
What is a TRID?
A Token Requestor ID (or TRID) is a merchant specific identifier that is used for provisioning merchant specific network tokens for card on file payment methods. Since card on file network tokens are merchant specific, there is higher trust with issuing banks and reduced fraud.
Do I need a TRID to use network tokens?
In order for network tokens to be available for merchants, Spreedly must have a Token Requestor ID (TRID) for the merchant. Card networks issue TRIDs independently, so a TRID will be necessary for each network you wish to issue network tokens.
How can I request a TRID? What do I do with the TRID once it’s available?
Spreedly can help you facilitate requesting TRIDs for each of our supported networks.
Once the TRIDs have been issued by the networks, a Spreedly support engineer will associate the TRIDs to your Spreedly account for use with your network token transactions. If you have a pre-existing TRID, please share this with your Spreedly Customer Contact so it can be associated to your account.
How Long Does Will It Take to Issue TRIDs?
The amount of time it takes to issue TRIDs will depend on the amount of TRIDs the networks are currently processing. For planning purposes, please plan for a time period between 2 weeks to 2 months. This being the case, we recommend requesting TRIDs as soon as you are interested in using network tokenization.
I already have TRIDs from another token requestor. Can I use my existing TRIDs?
If you have TRIDs from a previous token requestor, you can use those TRIDs with your Spreedly account to issue network tokens.
Please notify your Spreedly contact or support that you have TRIDs and they will work with you to have your TRIDs associated with your Spreedly account.
What if I only have received TRIDs for a single network? Can I start using network tokens?
While Spreedly's network solution supports multiple card networks, you do not need to have TRIDs for every network to being requesting network tokens. Take the example that you receive your Mastercard TRID prior to your Visa TRID; in this example, you can begin provisioning and transacting with Mastercard network tokens while you wait for your Visa TRID to be issued.
My business operates as a Platform, can Spreedly support my sub-merchants TRIDs?
At this point in time, Spreedly’s network token solution cannot support multiple TRIDs for multiple merchants.
However, this capability is planned on our 2021 roadmap. If you are interested in using network tokens for your platform and sub-merchants, please let your Spreedly Customer Contact know.
Our product team would love to chat and learn more about your use cases.
Does a TRID have any specific format or fixed character limit?
TRIDs are 11 characters in length. The first 3 digits represent the token service provider; as an example Mastercard TRIDs start with a 5, Visa TRIDs with a 4.
A full list of TSPs is available on the EMVCo site, some TSPs have more than one range.
Can a TRID be shared/exposed publicly?
TRIDs are not considered sensitive information. They are made publicly available in resources like Visa Business News so that issuing banks can be aware of new merchants using network tokens.
That said, we recommend using safe data practices with any data. Please limit the exchange of TRIDs to only necessary parties.
How long is a TRID valid for? Does it ever expire?
TRIDs do not expire. However there are circumstances where the networks may reclaim TRIDs and reassign them if it’s deemed necessary.
This can occur if a TRID has been issued for a merchant and has not been used for an extended period of time.
Is the TRID associated with my partnership with Spreedly? Will I need to request a new one when switching vendors?
Your TRID value is unique to your business and is not associated with Spreedly. However, your TRID will be used with Spreedly's Relationship ID to issue you network tokens and cryptograms.
Should you decide to switch to another token requestor token service provider (TR-TSPs), you will keep your TRID, and Spreedly with notify the network so that your network tokens can be associated with the new vendors Relationship IP.
Provisioning Network Tokens
Which card networks support network tokens?
Please view our Supported Card Networks section of our Network Tokenization guide for currently supported networks.
Which geographies support network tokens?
While Network Tokenization is supported globally, adoption rates with issuing banks varies depending on region and country.
At the time of writing (May 2021), we see regional adoption as such:
- North America (US and Canada) - Very Good
- Europe - Good
- Latin America Carribean - Good
- CEMEA - Very Good
- Asia Pacific - Good
Legend
Very Good > 79% Issuer Participation
Good > 50% Issuer Participation
Moderate < 50% Issuer Participation
Poor < 30% Issuer Participation
Please note that while network token adoption is rapidly rising globally, there are individual countries that can be ahead or behind in each region.
If you’re interested in Network Tokenization for a specific region or country, please contact Spreedly and we’ll work to get the latest country adoption information from our network partners.
What factors determine if a network token will be provisioned for a requested credit card?
When you request a network token be provisioned for a credit card, several factors determine if a token will be provisioned:
- Spreedly must support network tokenization for the card. Currently, Spreedly supports network tokenization for Visa and Mastercard.
- Your Spreedly account must have the network-specific TRID associated. Without the network TRID, networks and issuing banks cannot return a merchant-specific token.
- The issuing bank must participate in network tokenization. Adoption of network tokenization by issuing banks depending on the region the issuing bank is located. North American banks currently have the highest adoption, while Latin American and European bank support is growing rapidly.
How do I provision a network token?
For information about how you can provision a network token, please review the Provisioning Network Tokens portion of our Network Tokenization guide.
How will I know if the network token has been successfully provisioned for a payment method?
When making an API request that supports the retained: true or retain_on_success: true fields, then the response body will indicate whether a token has been successfully provisioned or not. The response message should contain a section that looks like this:
“network_tokenization": {
For more information about how you can provision a network token, please review the Provisioning Network Tokens portion of our Network Tokenization guide.
As a merchant, do I need to store the network token in my database?
No. Spreedly stores the network token as part of your Spreedly token. You only need to maintain access to the Spreedly Token.
Is it possible to get access to the network token numbers?
At this point in time it is not possible to retrieve the network token. If this is of interest to you, our product team would love to hear more about your use cases, we encourage you to contact us via your customer success team member.
Can I use network tokens in my transactions outside of Spreedly?
At this point in time Spreedly is not offering the distribution of network tokens and cryptograms. However, if this is of interest to you, our product team would love to hear more about your use cases, we encourage you to contact us via your customer success team member.
Can I selectively provision network tokens only for a subset of my customers?
Yes! Pass in the `provision_network_token: true` flag when adding the customer's payment method to provision a network token. Otherwise, you may set `provision_network_token: false` or not set at all.
Please keep in mind the environment has to be enabled for NT.
For more information about how you can provision a network token, please review the Provisioning Network Tokens portion of our Network Tokenization guide.
When I provision a token during a purchase transaction, will the token be used for the initial transaction? How will that impact transaction latency?
When a network token is provisioning is requested, the request must travel to both the card network and the issuing bank. This provisioning process can take between 5-6 seconds, which is much too long for a purchase transaction.
As a result, any purchase transaction that also requests a network token be provisioned will default to using the PAN for the initial transaction. Subsequent transactions for the same Spreedly payment method token can use the network token since it will be stored with the payment method.
How can I bulk provision network tokens for my existing payment methods? And is there a separate fee for that?
Spreedly engineering is currently working on a solution to bulk provision network tokens, however it is not currently available.
There is no additional fee to bulk provision tokens.
What if I have network tokens from a previous token requestor? Can the existing tokens be imported to Spreedly?
Network tokens are transferrable between token requestors. Depending on the number of existing network tokens, it is often advisable to transfer existing tokens rather than spend time reissuing tokens.
The transfer does require coordination between Spreedly, the original token requestor, and the card networks. If you have existing network tokens you would wish to transfer to Spreedly, please contact your Spreedly contact or support.
While network tokens do have an expiration date, the Spreedly solution handles the updates for you. Updates will be received and processed as long as the card account is valid and active with the issuing bank.
Transacting with Network Tokens
What transactions support network tokens, and how do I decide between using the credit card and the network token?
Network tokens are used whenever an Authorization occurs. As such, network tokens can be used when making Authorization and Purchase transactions via Spreedly.
When a merchant uses the Spreedly API to complete a payment transaction for a given Spreedly token they can include the element attempt_network_token: true to attempt using a network token for the transaction.
Spreedly has logic that checks multiple variables to determine if a network token will work for a transaction; if any variable does not pass, then the transaction will be made using the PAN associated with the Spreedly payment method token.
Alternatively, if the merchant desires the transaction be completed in PAN then the merchant can set attempt_network_token: false and the transaction will occur with PAN, skipping the use of a network token. This fits use cases where the merchant may desire to A/B test.
What gateways support network tokens?
Please view our Supported Gateways section of our Network Tokenization guide for currently supported gateways.
Support for additional gateways is in active development. For specific gateway requests, we recommend you contact your Spreedly Account Representative so they can share it with our product team.
Can I tell if a network token was used in a transaction?
In an effort to be transparent and empower merchants with data for internal reporting and logging purposes, authorization and purchase API transactions requesting the use of a network token include a network_tokenization data element in the API response. The network_tokenization data element explains whether or not a network token was used and information as to why.
Can you share a comprehensive list of possible errors when transacting with NT?
A list of network token errors, including error codes and verbose message, can be found in the response body portion of the Transacting with Network Tokens section of our Network Tokenization Guide.
Could there be latency concerns for transacting with NT?
Network Token transactions require the use of a cryptogram that must be passed with the network token to the acquirer. Cryptograms are generated at the time of the transaction and retrieved from the network. This process happens in milliseconds, so while there is additional latency for this process it should not affect the overall efficacy of the transaction experience
Can I choose if I want to use network tokens or not for particular transactions?
Yes, merchants can whether or not network tokens are used for a transaction. The transaction element attempt_network_token can be set to True or False, where True will attempt to use the network token or False will default to using the PAN regardless of if the payment method has a network token. If the flag is not set, the transaction always defaults to PAN.
How soon can I start using network tokens for a transaction, after a provisioning request has been made?
In general a network token is available between 5-6 seconds after it is requested when retaining a payment method.
As such:
- If you are retaining upon success for an Auth or Purchase transaction, PAN will be used for the initial transaction and the network token will be available for subsequent transactions. This is done to prevent delays in the checkout experience for customers.
- If you are retaining a payment method without a transaction, the network token should be available for usage between 5-6 seconds after being retained. Depending on your use cases and UX you may choose to use the network token for the transaction at this point.
For most merchants we recommend always setting the attempt_network_token: true. Our logic confirms that the network is not only available, but also in an active status. As such, we will use PAN if the network token has just been issued and still in an inactive status while it’s being activated by the networks.
When a transaction fails using a network token, do you retry it using the credit card?
If a transaction is made with a network token but the transaction fails with the network token, we do not proactively retry the transaction with the PAN instead.
Our conversations with the networks suggest that if the transaction fails with NT it will also fail with PAN. This said, merchant can choose to retry the transaction with PAN if they desire by setting the attempt_network_token:false for the 2nd transaction attempt.
Once a network token is provisioned, how can I use the network token?
Pass in the attempt_network_token: true flag on an authorize or purchase transaction. If the payment method has been previously provisioned with an active token, the transaction will be attempted using the network token automatically.
Deleting Network Tokens
Can I delete the network token associated with a single payment method?
When you redact the payment method, the associated network token is deleted automatically.
What happens to the network token when I redact the payment method?
We send a request to the network to delete the token and also redact it locally.
Network Token Statuses
What are LifeCycle Management Status Updates?
One of the benefits of Network Tokens is that they receive proactive updates to their status and metadata. As a result, Network Tokens have a status from the moment a token is requested until they are deleted. These statuses dictate if a network token and its underlying PAN can be used for a transaction.
What are the different token statuses and their meanings?
Inactive
The token has been requested but the token has not yet been activated.
Active
The Network Token is ready for transactions
Suspended
The network token is suspended and unable to transact. Issuing banks can suspend individual tokens if there is an issue with fraud or if the cardholder locks the card.
Deactivated/Deleted
Depending o the network, a network token can be in a deactivated or deleted status after it has been permanently deleted by the issuing bank or by the merchant. Issuing banks will delete a token if the account is closed.
Null
The most common cause for a 'null' status is we're awaiting a response from the network after first requesting the network token. Often this will resolve itself in 4-5 seconds. If you notice an abundance of Null status network tokens, please contact Spreedly and we'll investigate if there is an issue.
How can I view a network token's status?
You can view a network token status by using the Show API call on any payment method that has been tokenized. The same response is also available with the List API as well.
Please read our API documentation to learn how to use the Show or List API calls.
If the payment method has a network token associated with it, it will return a network token object in the response as seen in the example below. Otherwise, if there is no network token associated with the payment method, the response will not return the network token object.
{
"payment_method": {
"token": "GYxUicC6gSeFMgMas2s8U00AZ96",
"created_at": "2021-05-14T19:19:49Z",
"updated_at": "2021-05-14T19:19:50Z",
"email": null,
"data": null,
"storage_state": "retained",
"test": false,
"metadata": null,
"callback_url": null,
"last_four_digits": "3216",
"first_six_digits": "520424",
"card_type": "master",
"first_name": "Test",
"last_name": "Test",
"month": 1,
"year": 2023,
"address1": null,
"address2": null,
"city": null,
"state": null,
"zip": null,
"country": null,
"phone_number": null,
"company": null,
"full_name": "Test Test",
"eligible_for_card_updater": true,
"shipping_address1": null,
"shipping_address2": null,
"shipping_city": null,
"shipping_state": null,
"shipping_zip": null,
"shipping_country": null,
"shipping_phone_number": null,
"payment_method_type": "credit_card",
"errors": [],
"network_token": {
"status": "ACTIVE"
},
"fingerprint": "f9efaf874494bf8e322c443b1bf19ad6e37a",
"verification_value": "",
"number": "XXXX-XXXX-XXXX-3216"
}
}
Testing Network Tokens
Testing Prerequisites
Before you can begin testing network token provisioning and transactions, you will need to have been issued Token Requestor IDs by the card networks.
Once your TRIDs are available (one or all), Spreedly support can assist you in enabling network tokens for your production environment.
The TRIDs will be used when making requests to provision network tokens and for transactions with network tokens; these requests will involve communication with the networks and issuing banks.
Provisioning a Network Token for a single payment method
Please refer to the Provisioning Network Tokens section of our guides for detailed code examples.
Once your product environment has been enabled for network tokens, you’re ready to start requesting network tokens.
Network token provisioning can be completed on a per payment method basis. As such, you’re able to test provisioning network tokens with individual payment methods and single API calls.
Please note that the networks do not supply test cards.
Since this is the case, we recommend you test provisioning on a handful of trusted payment methods, be them personal cards or QA cards you use for testing transactions.
Once you’ve identified the cards you’d like to test, you can provision a network token by setting the `provision_network_token: true` in your API requests. For testing we recommend this in two ways:
- For an existing payment method, you can include the `provision_network_token: true` in an authorization call to the Spreedly test gateway. This requests an actual token, while replying with a mock authorization
- For a new payment method, you can include `provision_network_token: true` while retaining the payment method
Once you’ve submitted your API request, please note `network_tokenization` element of the response body.
A successful tokenization will include `”provisioned": true` in the network tokenization section of the response.
We recommend trying this process multiple times as not all issuing banks will provide tokens. This should result in several tokens issued and also the display error messages as well when tokens cannot be issued.
Testing transactions with a single network token.
Please refer to the Transacting with Network Token section of our guides for detailed code examples.
Much like provisioning a network token, transactions with network tokens can also be made on a per-transaction basis. This will allow you to make single API requests using network tokens without needing to change your existing flows.
Once you’ve issued a network token for a payment method, you can now use that payment method to complete a transaction on a gateway that supports network tokens.
We recommend making several low dollar amount transactions such as Authorize, Purchase, and Verify transactions with your gateway of choice to test these transactions. Setting the element attempt_network_token: true in the requests will pass the network token to the gateway.
Should the network token not be used for the transaction, our response will return `"attempted": false` in the network token section of the response and an error code provided to explain why NT was not used. In this event, the transaction will have used the PAN to attempt to complete the transaction.
For those curious to test this functionality, we recommend routing the transaction to a gateway that does not support NT transactions, while also leaving the element attempt_network_token: true in the request. Since the gateway does not support NT, the transaction will always fall back to the PAN.
A/B Testing with Network Tokens
Since transactions with network tokens can be enabled or disabled per transaction, this allows your engineering team to A/B test network tokens vs PAN transactions.
As an example, if I want to test network token transactions with 10% of my transactions, then I can have my application set element attempt_network_token: true for every 10th transaction.
The analysis of the success of NT over PAN can be conducted by reviewing the responses.
Transactions that request NT be attempted will contain the element
"network_tokenization": {
"attempted": true/false,
...
}
For any transaction where attempted:true, then Spreedly sent the network token to the payment gateway for processing. It’s the success or failure of these transactions that show the impact of network tokens on success rates.
Alternatively, if attempted:false is in the response, then Spreedly completed the transaction with PAN instead and will have supplied a reason why NT could not be used.
The method above can be used for your own data analytics. However, we recommend partnering with your Spreedly customer account manager to let them know of any testing you plan.
Our product team can run aggregated reports for your transactions that can assist in analyzing the success of network tokens. (Note that these reports are planned to be added to your Spreedly dashboard in the future)
Imports, Exports, and Network Token Distribution
I already have acquired Network Tokens through my past vendor. How can I export those to my Spreedly Vault?/Will I be able to import existing network tokens provisioned outside of Spreedly?
Card networks have advised us that it is possible for network tokens to be exported from one token requestor token service provider (TR-TSP) and reassigned to another. While the token itself should not change, the token must be updated so the new TR-TSP can issue cryptograms and receive life cycle management updates.
Given the current state of network token adoption, transfer of tokens from one vendor to another has not been frequent. As such, if you need export/import assistance, we advise you contact us so we can work with you, your existing provider, and the networks to ensure a smooth transition.
Will I be able to export network tokens when exporting payment methods?
Similar to importing network tokens (see above) an export of network tokens from Spreedly is possible but will require coordination between Spreedly, the token recipient, and networks.
Given the current state of network token adoption, transfer of tokens from one vendor to another has not been frequent. As such, if you need export/import assistance, we advise you contact us so we can work with you, your existing provider, and the networks to ensure a smooth transition.
Can I use Payment Method Distribution to distribute network tokens?
At this point in time Payment Method Distribution of network tokens and cryptograms is not supported. However, our product team is considering this functionality for future iterations and would love to hear more about your use cases. Please notify your Spreedly customer contact so we can discuss further.
Using Network Tokens and 3DS2
Does Spreedly support the usage of network tokens for 3DS2 transactions?
At this point in time we recommend that all 3DS2 transactions continue to only use PAN; this can be achieved by setting the attempt_NT flag to false during a transaction that requires 3DS2.
While network tokens are designed to work with 3DS2 transactions, our teams have not tested the interoperability at this point in time. Given the critical nature of 3DS2 for successful EU transactions, we recommend prioritizing 3DS2 with PAN until our teams can thoroughly test NT transactions.
If you desire to use 3DS2 and NT jointly, please let your Spreedly customer contact know so the message can be shared with our product teams.
Using Network Tokens and Smart Routing
Does Spreedly support the usage of network tokens with Smart Routing?
At this point in time we recommend that all transactions using our smart routing API continue to only use PAN; this can be achieved by setting the attempt_NT flag to false during the transaction.
While network tokens are designed to work with transactions using smart routing, our teams have not tested the interoperability at this point in time.
If you desire to use smart routing and NT jointly, please let your Spreedly customer contact know so the message can be shared with our product teams.
Other
Is Spreedly considering expanding network tokens to more networks?
Yes, Spreedly is evaluating expanding network tokenization to other popular networks such as Discover and American Express.
However, at this point in time Spreedly is committing to smooth adoption of our initial network token offering and expansion to these networks is not on our immediate roadmap.
Are there any differences I need to consider / plan for based on specific network solutions?
While the networks individual network token offerings do have unique nuisances, one of the benefits of using Spreedly’s solution is that we abstract out these differences and unify them into a single network token solution. As such there are no network differences that a merchant must plan for other than perhaps the different amount of time it takes the merchants to issue TRIDs.
Can using NT hamper my ability to perform data analysis on cardholder data? If yes, will Spreedly offer any kind of analytics as a service?
Because our network token solution still maintains the original PAN for the customer, there should be no impact in card data analysis. Merchant will have the same ability as today to analyze customer’s payment profile like card type, purchase amount, etc.
If anything, network tokenization offers the potential for more data to be analyzed. In future iterations merchants will have access to token status and card art, that could drive enhanced customer communication.
If a transaction is made with a network token, does it impact the liability of chargebacks?
No, chargebacks on a transaction made with a network token are treated the same as chargeback made with a regular 16 digit PAN. There are no benefits, nor penalties.
Do I need to notify my users about the use of network tokens?
It's not required that merchant notify their customers that network tokens are being issued for their cards on file. However, if a merchant desires to list this in their user agreements, the networks recommend referring to the token as a ‘Digital Account Number’. Keep in mind this may cause confusion with the customer.
