Meaning
Account protection processes that replace the sixteen digit account number on a payment card with a non-sensitive surrogate value reduce the risk of data theft during transmission. Through primary account number substitution, the actual financial credentials are never stored on the merchant server or the mobile device of the customer. This technique is a fundamental requirement for secure mobile wallet implementations and card on file services.
Data Devaluation
Thieves who successfully breach a database find only useless tokens rather than actionable credit card information. Because the surrogate values used in primary account number substitution are often restricted to a specific merchant or device, they cannot be used for fraudulent purchases elsewhere. This devaluation of the stolen data makes the target less attractive to organized crime groups.
Merchant Liability
Risk of heavy fines from card networks is lower when sensitive data is not present in the environment. Compliance is simplified.
Protection Channel
Protection extends across all points of the sales channel from the web browser to the payment gateway. Since primary account number substitution happens early in the transaction flow, the exposure of the real account number is minimized. Contracts between retailers and payment processors often mandate this method as a condition for favorable processing rates.