How it Works

To create a network token, Braintree—acting as a Token Service Provider/Acquirer—sends a card (the PAN) stored in a merchant's Braintree Vault to a card network such as Visa or Mastercard. The card network will then provision a network token which is sent back to Braintree and stored in the merchant's vault. Network Tokens are specific to a card and one merchant; so no one token can be used at more than one merchant.

Once a Network Token is provisioned, it can be used to process a transaction. When a customer goes to checkout, Braintree sends the token from a merchant's vault along with a one-time use cryptogram to the card network who then will exchange the token with a PAN and send to the Issuer to process the transaction.

Unlike a traditional PAN, a Network Token can receive Lifecycle Management (LCM) Updates. These updates occur whenever a card is reissued, stolen, or lost. Traditionally, whenever a card number was updated, the burden was on the cardholder to update their card details before using the card. With Network Tokens, any update from a card issuer is passed through the card network and to Braintree, and the card details are updated in the merchant's Braintree vault. Now, when a cardholder goes to checkout, the updated card/token is ready to use and can help avoid a failed transaction which may lead to churn or cart abandonment.

Network Token-issuing card networks have their own set of eligibility criteria when they receive a request for card tokenization. Card networks will sometimes run a $0 verification before issuing a network token to ensure the card is active and not fraudulent, similar to regular card verifications run at the time of vaulting. These $0 verifications may show up in the cardholder's credit card statement but are not monetary charges and do not affect merchant operations in any way. If a card is sent to the card networks to be tokenized, Braintree does not have any control over whether or not a $0 verification is run on the card as part of tokenization.