🪴 Nishanth Gobi

Visa Tokenization

3 min read

When you use a saved Visa card on Amazon, the underlying process relies on a complex, multi-party exchange to swap your real card number with a token. This specific framework is known as Token-on-File (ToF).

Here is exactly how the process unfolds, step-by-step.

The Ecosystem Players

To understand the steps, it helps to know who is talking to whom:

  • You / Amazon: The consumer and the merchant website.
  • Token Acquirer/ Requestor: The payment gateway or backend processor handling Amazon’s checkout (Amazon often acts as its own Token Requestor).
  • Visa Token Service (VTS): The central vault mapping tokens back to real card numbers.
  • Issuer: The bank that printed your physical card.

Phase 1: Provisioning (Saving the Card)

This setup phase happens the very first time you add your Visa card to your Amazon account, or when Amazon migrates its existing stored database to tokens.

 [ Amazon ] ──(1. Send Real PAN)──> [ Visa Token Service ] ──(2. Check Eligibility)──> [ Your Bank (Issuer) ]
     ▲                                      │                                                 │
     │                                      ▼                                                 ▼
 (4. Store Token) <───────────────(3. Generate Token) ────────────────────────────────(Approve / Risk Check)
  1. Card Entry: You enter your 16-digit card number (Primary Account Number or PAN), expiration date, and CVV into Amazon.
  2. Token Request: Amazon safely passes this data to the Visa Token Service, acting as a “Token Requestor.” Amazon asks: “Can I get a secure token for this card?”
  3. Issuer Validation: Visa contacts your bank (the Issuer). The bank performs a background risk assessment to ensure your account is active and safe.
  4. Token Generation: Once approved, VTS generates a unique 16-digit digital token. This token looks exactly like a standard credit card number and passes basic card checks, but it is entirely different from your real card.
  5. Storage swap: Visa sends the token back to Amazon. Amazon securely stores this Token in their database instead of your real card number. Your real card details are never saved on Amazon’s servers.

Phase 2: Transaction Checkout (Buying an Item)

This phase happens every time you click “Place your order” on Amazon using that saved card.

 [ You ] ──(1. Click Buy)──> [ Amazon ] ──(2. Send Token + Crypto)──> [ Acquiring Bank ] ──> [ Visa Network ]
                                                                                                  │
                                                                                                  ▼
 [ Your Bank ] <──(5. Approve)── [ Visa Network ] <──(4. Swap Token to Real PAN)── [ Visa Token Vault ]
  1. Initiation: You hit “Place your order.” Amazon pulls up your saved profile.
  2. Cryptogram Generation: Amazon requests a unique, one-time transaction cryptogram (a dynamic security code) from Visa. This cryptogram proves that the token is being used on Amazon and nowhere else.
  3. Routing: Amazon sends the Token, the Cryptogram, and the purchase amount to its bank processor (the Acquirer).
  4. De-Tokenization: The processor routes the transaction to the Visa network. Visa intercepts it, looks up the token in its secure vault, verifies the cryptogram, and swaps the token back to your real 16-digit card number.
  5. Authorization: Visa sends your real card number to your bank. Your bank checks if you have enough funds, approves the transaction, and sends the approval back to Visa.
  6. Completion: Visa wraps the approval back into a tokenized format, sends it back down the chain to Amazon, and your screen refreshes to say “Order Confirmed!”

Why need for a processor? Can Amazon’s backend can’t just do it?

Graph View