Just curious, what is the common algorithm used to tokenize a user's credit card? I know lots service use PRNG (random number). Does it just re-gen a random number when there is a confliction? What about use UUID as token? What are the pros and cons?
Tokenization just uses random number generators to generate a certain ID and link that ID to a card, there is no way you can for instance reverse engineer the token from a card number or vice versa.
Sometimes the last 4 digits are kept as part of the token to display to the user. This is useful for certains shops, like Amazon, where a user might have configured several credit cards.
Normally tokenization happens in such a way that the randomness and keyspace are so large that colliding tokens are very unlinkely. In case a token would already be present it just needs to re-generate the random number prior to commiting into the database (often databases have unique constraints on the token as well as they're used as secondary or primary keys).
The pros are that you can reduce your PCI scope significanty. For instance databases used for analytics on a person's spend needn't be part of the PCI zone as no PAN data will be present.
There are no cons. Some con you might have is for card acquirers that do not want their helpdesk to have access to their clients card numbers. So it might be that the acquirer needs to print an additional identification number on the card of the customer so he can be identified.