Verification note
Reviewed on 28 October 2026 against RBI tokenisation guidance and official Mastercard and Visa information. Supported cards, merchants, devices, wallet applications and token-management menus are time-sensitive. Confirm current availability with your issuer and payment service before acting.
When you save a credit card on a shopping website or add it to a supported mobile wallet, the service may use tokenisation instead of storing or transmitting the complete card number.
Tokenisation replaces the actual card details with an alternate code called a token. If a merchant's stored payment data is exposed, the token is intended to reduce the usefulness of that data outside its permitted context.
What is a card token?
RBI defines a token as an alternate code replacing actual card details. For device-based tokenisation, it is unique to a combination of the card, the token requestor and the identified device. The token requestor is the service that accepts your request and sends it to the card network or issuer.
De-tokenisation means converting the token back into the actual card details. RBI says tokenisation and de-tokenisation may be performed by an authorised card network or card issuer under the applicable framework.
The token is not your OTP, PIN, CVV or UPI PIN. Those credentials have different purposes and should never be shared with a caller or merchant representative.
Device token versus card-on-file token
| Type | Typical use | Important point |
|---|---|---|
| Device token | Mobile wallets, wearables, contactless or in-app payments | Can be linked to a particular device and use case |
| Card-on-file token | A saved card at an online merchant or application | Merchant keeps the token rather than the complete card credentials |
| Manually entered card | Guest checkout without saving the card | You enter the details again for the transaction |
These descriptions are simplified. The exact parties and processing route depend on the issuer, card network, merchant, payment aggregator, wallet and device.
How tokenisation works at checkout
Choose the option to save, secure or tokenise the card at a supported merchant or service.
Review the request instead of accepting a pre-selected option.
Give explicit consent and complete the issuer's Additional Factor of Authentication.
The card network or issuer creates the token for the approved context.
The merchant stores or uses the token rather than the complete card number.
Manage or remove the saved token through the available merchant or issuer channel.
RBI says registration must use explicit customer consent and Additional Factor of Authentication. It must not rely on a forced, default or automatically selected checkbox.
What merchants may retain
RBI's card-on-file framework restricts entities in the payment chain, other than card issuers and card networks, from storing the actual card data. For transaction tracking and reconciliation, limited details such as the last four digits and issuer name may be retained under the applicable standards.
This is why a merchant can still show a familiar masked card such as “ending 1234” even though it uses a token for payment processing.
Tokenisation reduces exposure of the actual card credentials, but it does not make every transaction risk-free. Protect the phone, merchant account, email account and device passcode, and continue reviewing transaction alerts.
Is tokenisation optional and free?
RBI says customers may choose whether to tokenise a card and should not pay a charge for the tokenisation service. Customers may register or deregister a card for a supported use case and can request tokenisation for multiple cards and devices.
An issuer may decide, based on risk considerations, whether a particular card can be registered by a token requestor. Availability can therefore differ by issuer, network, merchant, wallet and card variant.
Manual confirmation required: Check whether your exact card, device and merchant support tokenisation and where token controls appear. App navigation and supported services can change.
Replacing a card or losing a device
A replaced or renewed card can affect saved tokens because the card credentials or issuer status may change. Some services can refresh credentials, while others may require the card to be added again. Check important subscriptions after replacement rather than assuming every token will continue.
If a phone or wearable containing tokenised cards is lost, secure the device account and report the event to the card issuer. RBI says issuers should provide easy access for reporting a lost identified device or another event that may expose tokens to unauthorised use.
Removing a card from one merchant or wallet does not necessarily remove tokens created for other merchants or devices. Review each service separately.
Confirmed facts and interpretation
Confirmed: RBI says tokenisation replaces actual card details with an alternate code, is voluntary and free for customers, and requires explicit consent with Additional Factor of Authentication. Merchants may retain limited masked information but not the complete card credentials under the card-on-file framework.
Editorial interpretation: Tokenisation is generally safer than letting multiple merchants retain usable card details. It should be combined with device security, transaction alerts, strong merchant-account passwords and regular review of saved payment methods.
Key takeaways
- A token replaces the actual card details for a permitted payment context.
- Device and card-on-file tokens serve different use cases.
- Tokenisation is voluntary and should not carry a customer charge.
- Registration requires explicit consent and issuer authentication.
- A token is different from an OTP, PIN, CVV or UPI PIN.
- Report a lost tokenised device to the issuer and secure the device account.
Frequently asked questions
Is credit-card tokenisation mandatory?
No. RBI says tokenisation is voluntary for customers. You may choose tokenisation where it is supported or manually enter card details at checkout.
Does tokenisation cost money?
RBI's FAQ says customers should not be charged for using tokenisation.
Is a token the same as my card number?
No. A token is an alternate code used in place of the actual card details. It can be restricted to a particular merchant, device, token requestor or use case.
Can a token be used at every merchant?
Not necessarily. RBI describes tokens as unique to a combination that includes the card and token requestor, and device-based tokens can also be tied to an identified device.
What should I do if a phone containing tokenised cards is lost?
Secure the device and wallet account, then contact the card issuer through an official channel. RBI requires issuers to provide an easy way to report a lost device or another event that may expose tokens.
Sources checked on 28 October 2026
Factual-review checklist
- Compared the title, slug, keyword, core topic and main facts with the current main branch and all 25 open pull requests; no dedicated or substantially overlapping article was found.
- Rejected a new monthly market article because an existing CreditCardRanker market-data page already covers that topic.
- Used RBI as the primary source and official Mastercard and Visa material as supporting sources.
- Kept tokens separate from OTPs, PINs, CVVs and UPI PINs.
- Did not claim that every issuer, merchant, wallet, card or device supports tokenisation.
- Internal links point to published CreditCardRanker pages.
- Manual confirmation remains required for supported cards, merchants, devices, applications and token-management menus.