Lesson 4 · Practitioner · Both · 14 min
Tokenization & 3-D Secure
Reduce PAN exposure with network tokens and improve CNP authentication with 3DS — including liability shift intuition and UX trade-offs.
Objectives
- ▸Differentiate merchant vault tokens vs network tokens vs device wallet tokens
- ▸Explain 3DS challenge vs frictionless flows
- ▸State what liability shift means for product/risk
- ▸Balance conversion vs fraud when applying 3DS exemptions
Storing raw PANs expands PCI scope and breach blast radius. Tokens replace PANs in merchant systems. Not all tokens are equal: a gateway customer_token may be processor-specific; network tokens (Visa/MC/RuPay token services) can improve auth rates and lifecycle updates when cards are reissued; device wallet tokens (Apple/Google Pay) use device-bound cryptograms.
- PAN → token mapping lives in a vault with strict access
- Network tokens can auto-update on card reissue
- Cryptogram per transaction binds wallet tokens to a device/context
Key terms
TokenizationNetwork tokenDevice cryptogram3-D SecureACSFrictionlessChallengeLiability shiftECICAVV