# Network Tokenization: A Guide for Subscription Founders

> Network tokenization explained for SaaS founders: how network tokens differ from PANs and PSP tokens, how they survive card reissues, and what to ask your provider.
- **Author**: Deepak Jangir
- **Published**: 2026-10-19
- **Category**: Payments, Security
- **URL**: https://dodopayments.com/blogs/en/network-tokenization

---

Network tokenization replaces a customer's real card number (the PAN) with a token issued by the card network itself, such as Visa or Mastercard, instead of by your payment processor. Each charge using that token carries a one-time cryptogram, and the token stays linked to the underlying card account, so it can keep working when the physical card expires or is reissued. For recurring billing, that means fewer renewals that fail simply because a card changed.

Here is the problem it addresses. You run a SaaS product with a few thousand monthly subscribers. Every month, a slice of renewals fails, and when you look at the decline reasons, many of them are not "insufficient funds." They are expired cards, cards reissued after a data breach, and cards replaced after a bank migration. The customer still wants your product. Their card just changed, and your stored credential did not.

This guide explains what network tokens are, how they compare with PANs and processor tokens, how lifecycle updates work, where they fall short, and the questions worth asking your payment provider.

## What Is Network Tokenization?

Network tokenization is a card-network service that substitutes a card's PAN with a network-issued token for storage and transmission. Visa runs this through Visa Token Service, and Mastercard through Mastercard Digital Enablement Service (MDES). Other networks run comparable programs. The network acts as the token service provider: it creates the token, maintains the mapping back to the real card, and coordinates with the issuing bank.

The party that requests a token is called the token requestor. That can be a merchant, a payment processor, a gateway, or a wallet. When a customer saves a card, the token requestor asks the network to provision a token, the issuer approves it, and from then on the merchant charges the token instead of the PAN. The consent and stored-credential rules for those later charges are covered in our guide to [card-on-file payments](https://dodopayments.com/blogs/card-on-file-payments).

Two properties make network tokens different from a plain stored card:

- **Domain restriction.** A network token is typically bound to a specific token requestor and use case. If it leaks, it is far less useful to an attacker than a raw card number.
- **Per-transaction cryptograms.** Each payment with a network token includes a cryptogram, a one-time value generated for that transaction. The issuer can verify it, which makes a replayed or stolen token hard to reuse.

You have almost certainly used network tokens already. Mobile wallets like Apple Pay and Google Pay rely on device-bound network tokens. The same technology is available for card-on-file payments in browsers and APIs, which is where it matters most for subscription businesses.

For a broader primer on tokens in general, including how they shrink PCI scope, read our guide to [payment tokenization for SaaS](https://dodopayments.com/blogs/payment-tokenization).

## Network Tokens vs PSP Tokens vs Raw PANs

Most founders already use tokens without thinking about it. When your payment provider returns a `payment_method_id` or similar identifier for a saved card, that is a PSP token (also called a vault or processor token). The difference between a PSP token and a network token is who issues it and what it can do.

| Dimension | Raw PAN | PSP (processor) token | Network token |
| --- | --- | --- | --- |
| Issued by | The issuing bank (the card number itself) | Your payment provider | The card network |
| Where it is valid | Anywhere, which is the risk | Only inside that provider | Bound to a token requestor and domain |
| PCI scope for you | Heavy if you store it | Reduced, provider holds the PAN | Reduced, PAN stays with network and provider |
| Survives card reissue | No | Only if provider refreshes the PAN behind it | Often yes, issuer updates the mapping |
| Per-transaction cryptogram | No | No | Yes |
| Value if stolen | High | Low outside the provider | Low, cryptogram required |
| Portability between processors | Fully portable, but you should not hold it | Usually requires a data migration | Depends on who the token requestor is |

A useful way to think about it: a PSP token protects you from the PAN. A network token protects the whole ecosystem from the PAN, and it carries information the issuer can use to trust the transaction.

These layers often stack. A provider might give you a PSP token, while behind the scenes it holds a network token for the same card instead of, or alongside, the raw PAN. From your code's perspective nothing changes, but the authorization request that reaches the issuer looks different.

If you are building directly against card data, our breakdown of [raw card API access and PCI compliance](https://dodopayments.com/blogs/raw-card-api-pci-compliance) covers why most teams should avoid touching PANs at all.

## How Network Token Lifecycle Updates Work

The biggest practical benefit of network tokens for subscriptions is lifecycle management. A network token is linked to the cardholder's account rather than to a specific piece of plastic. When the issuer reissues a card, the issuer updates the network's mapping, and the token you store keeps pointing to a valid card.

Here is the flow from first save through a card reissue:

```mermaid
flowchart LR
    A["Customer saves card at checkout"] --> B["Token requestor asks network for token"]
    B --> C["Network checks with issuing bank"]
    C -->|"Approved"| D["Network token provisioned and stored"]
    D --> E["Renewal: charge token + one-time cryptogram"]
    E --> F["Network maps token to current card"]
    F --> G["Issuer authorizes"]
    H["Card expires or is reissued"] --> I["Issuer updates network mapping"]
    I --> F
    J["Account closed or flagged"] --> K["Token suspended or deleted"]
    K --> L["Ask customer for new payment method"]
```

Three lifecycle events matter for a billing team:

- **Expiry and reissue.** The card gets a new expiry date or a new number. The issuer pushes the update to the network, and the token keeps working without any action from you or the customer.
- **Suspension.** If the account is frozen, for example during a fraud investigation, the token can be suspended so charges fail cleanly instead of being retried blindly.
- **Deletion.** When the account is closed, the token is deleted. Your provider should surface this so you stop retrying and prompt the customer for a new card.

The key difference from older approaches is timing. With a raw PAN or a PSP token that is not refreshed, you only find out about a reissue when the renewal declines. With network tokens, the update can happen before your next billing date.

## Why Network Tokens Help Recurring Billing

Subscription revenue depends on stored credentials staying usable for months or years. Network tokens help in two broad ways: fewer avoidable declines and lower fraud risk.

### Fewer declines from expired and reissued cards

A meaningful share of failed renewals come from card changes rather than a lack of funds. Our list of [credit card decline codes](https://dodopayments.com/blogs/credit-card-decline-codes) shows how often responses like "expired card" or "invalid account" appear in recurring billing. When the token follows the account through a reissue, many of those declines never happen.

This feeds directly into involuntary churn, the revenue you lose from customers who never chose to leave. If you have not measured it yet, our guide to [involuntary churn from failed payments](https://dodopayments.com/blogs/involuntary-churn-failed-payments) walks through how to size the problem.

### Higher issuer confidence at authorization

Card networks report higher approval rates for network-tokenized transactions compared with PAN-based card-not-present transactions. The reasoning is straightforward: the issuer receives a token it recognizes plus a cryptogram it can validate, so it has more reason to trust the charge. Results vary by issuer, region, and business model, so treat this as a direction rather than a guaranteed uplift, and ask your provider for data from your own traffic.

Card-not-present payments are where issuers are most cautious, which is why [card-not-present transactions](https://dodopayments.com/blogs/card-not-present-transactions) tend to see more declines than in-person ones. Anything that gives the issuer better signals helps.

### Lower fraud exposure

Because each network-token transaction needs a fresh cryptogram, a stolen token is much harder to monetize. That does not stop every attack. Fraudsters running [card testing attacks](https://dodopayments.com/blogs/card-testing-fraud) usually work with stolen PANs at your checkout, so you still need velocity limits, fraud scoring, and authentication at the point of entry. Network tokens protect the credentials you already store; they do not replace checkout defenses like [3D Secure authentication](https://dodopayments.com/blogs/3d-secure-3ds-payment-authentication).

## Network Tokenization vs Card Account Updater

Network tokens and card account updaters solve overlapping problems, so they are often confused. Both aim to keep stored card credentials current. They differ in how they do it.

| Dimension | Card account updater | Network tokenization |
| --- | --- | --- |
| What you store | PAN or PSP token backed by a PAN | Network token |
| How updates arrive | Batch or real-time query to the network's updater database | Issuer updates the token-to-account mapping |
| When you learn about a change | When the updater is queried before or after a charge | Often never, the token just keeps working |
| Covers closed accounts | Yes, returns a closed-account flag | Yes, token is suspended or deleted |
| Adds cryptogram security | No | Yes |
| Depends on issuer participation | Yes | Yes |

An account updater refreshes the card data you hold. A network token makes the card data you hold matter less. In practice, many providers use both: network tokens where the issuer supports them, and an updater as a fallback for cards that cannot be tokenized. Our guide to the [account updater service](https://dodopayments.com/blogs/account-updater-service) explains how updater programs like Visa Account Updater and Mastercard Automatic Billing Updater work in detail.

Neither one removes the need for a recovery process. Some cards will always fail: the customer ran out of funds, hit a limit, or the bank blocked the charge. That is where [payment retry logic](https://dodopayments.com/blogs/payment-retry-logic) and a well-designed [subscription dunning recovery sequence](https://dodopayments.com/blogs/subscription-dunning-recovery-sequence) take over.

## Limitations of Network Tokenization

Network tokens are a real improvement, but they are not universal, and founders should know where they stop.

- **Issuer and region coverage varies.** Not every issuer supports network tokens for card-on-file use, and adoption differs by country and card brand. A portion of your customers' cards may still fall back to PAN-based processing.
- **Not every card type is eligible.** Some prepaid, commercial, or regional cards may not be tokenizable, depending on the network and issuer.
- **Portability depends on the token requestor.** Network tokens are bound to the party that requested them. If your processor is the token requestor, the tokens generally stay with that processor. Moving to a new provider usually means migrating the underlying card data and having the new provider provision fresh tokens. Merchants who act as their own token requestor have more control, but also take on more integration and compliance work.
- **Declines still happen.** Network tokens fix credential staleness. They do not fix insufficient funds, spending limits, or issuer fraud rules. You still need retries, dunning, and customer communication.
- **Visibility can be limited.** Many providers apply network tokens behind the scenes and do not expose whether a given charge used one. That makes it hard to measure impact unless your provider reports on it.

If you are planning a processor change, the portability point deserves attention early. Our list of [billing system migration mistakes](https://dodopayments.com/blogs/billing-system-migration-mistakes) covers how card data moves between providers and where migrations tend to break.

## What Founders Should Ask Their Payment Provider

You rarely integrate network tokens directly. Your provider does, or does not. These questions help you understand what you are actually getting:

- **Do you provision network tokens for card-on-file payments?** Ask which networks and which regions are covered.
- **Who is the token requestor?** This determines what happens to your tokens if you ever switch providers.
- **What is the fallback when a card cannot be tokenized?** Look for a clear answer, such as an account updater or PAN-based processing with retries.
- **Can you show approval rates for tokenized vs non-tokenized charges?** Real data from your own volume beats any industry claim.
- **How are lifecycle events surfaced?** You want to know when a token is suspended or deleted so you can ask the customer for a new card instead of retrying a dead credential.
- **What happens after a decline?** Ask how retries are scheduled, whether dunning emails are included, and how recovery is priced.

The last question often matters more than the first. Even with perfect credential hygiene, a recurring business will see some declines every month. How your provider recovers those payments is what ultimately shows up in your MRR. Our guide to [reducing payment declines](https://dodopayments.com/blogs/reduce-payment-declines) covers the full set of levers beyond tokenization.

## How Dodo Payments Handles Stored Cards and Failed Payments

Dodo Payments is a Merchant of Record built for SaaS, AI, and digital product companies. On the card side, card numbers are tokenized on entry, so your application never handles raw PANs. Dodo is PCI DSS Level 1 and adds fraud scoring, CVV validation, and 3D Secure at checkout. You can save cards for one-click and recurring charges using the flows described in the [card payments documentation](https://docs.dodopayments.com/features/payment-methods/cards).

For recurring revenue, Dodo handles payment retries and dunning for failed subscription payments. Recovery is free to enable and costs 5% only on revenue that is actually recovered, so you are not paying for retries that do not work. Subscriptions accept cards, Google Pay, Cash App Pay (USD), and UPI Intent (INR); bank debits like ACH and SEPA are one-time only on Dodo, which is a trade-off to plan for if your customers prefer bank payments for renewals. The [subscription feature docs](https://docs.dodopayments.com/features/subscription) cover the supported methods in detail.

If you want to react to failures in your own product, for example by showing an in-app banner asking the customer to update their card, Dodo emits webhook events you can subscribe to. The guide to [handling payment failures](https://docs.dodopayments.com/developer-resources/handle-payment-failures) and the reference for [transaction failure reasons](https://docs.dodopayments.com/api-reference/transaction-failures) show what each failure means and how to respond. Our broader write-up on [dunning management](https://dodopayments.com/blogs/dunning-management) explains how to combine automated retries with customer messaging.

Because Dodo acts as the legal seller, it also handles sales tax, VAT, and GST, compliance, and chargebacks, so the payment stack around your stored cards is covered without stitching together separate tools. You can see plan details on the [Dodo Payments pricing page](https://dodopayments.com/pricing).

## FAQ

### Are network tokens the same as Apple Pay or Google Pay tokens?

They use the same underlying technology. Wallet tokens are network tokens bound to a specific device, while card-on-file network tokens are bound to a merchant or processor for online and recurring payments.

### Do network tokens remove the need for PCI DSS compliance?

No. They reduce the sensitive data in your environment, but you still have PCI obligations based on how you accept cards. Using a provider that tokenizes card numbers on entry keeps your scope much smaller than handling PANs directly.

### Can I move my network tokens to a new payment processor?

Usually not directly, because network tokens are bound to the token requestor that provisioned them. When you switch processors, the underlying card data is typically migrated and the new provider provisions its own tokens.

### What is a cryptogram in network tokenization?

A cryptogram is a one-time value generated for each transaction that uses a network token. The issuer validates it during authorization, which makes a stolen or replayed token very hard to use for fraud.

### Do network tokens stop all failed subscription payments?

No. They mainly prevent declines caused by expired or reissued cards. Declines from insufficient funds, spending limits, or issuer fraud rules still need payment retries and a dunning process to recover.

## Final Thoughts

Network tokenization fixes a quiet but expensive problem for subscription businesses: stored cards going stale. By replacing PANs with network-issued tokens, adding a cryptogram to every charge, and letting issuers update credentials behind the scenes, it cuts a category of avoidable declines and makes stored credentials less valuable to attackers.

It is not a complete answer. Coverage depends on issuers and regions, portability depends on who requested the tokens, and plenty of declines have nothing to do with stale cards. The businesses that hold on to the most recurring revenue combine good credential hygiene with retries, dunning, and clear customer communication.

If you want a billing stack where card numbers are tokenized on entry, tax and compliance are handled for you, and failed payment recovery is priced only on results, take a look at [Dodo Payments](https://dodopayments.com).
---
- [More Payments articles](https://dodopayments.com/blogs/category/payments)
- [All articles](https://dodopayments.com/blogs)