With tokenization, the sensitive cardholder data obtained during a card transaction is replaced with a marker — or token — in the merchant’s system. A token takes the place of the original data; however, possessing the token does not allow the holder to know anything about the original data or the tokenization scheme. Unlike encryption, the token cannot be reversed to reveal the original data. Retrieving the original data that was replaced by the token requires a database that maintains the relationship between the token and the original data. The data is stored so when merchants need to access this information to issue a refund or for another reason, they can retrieve it.
Tokenization secures the information stored only after it is initially authorized or the original data is replaced with the token. Tokenization alone does not provide protection against data theft during transmission.