I am reading the tokenization product security guidelines of PCI-DSS but I do not see the time of expiration of the token. Does it have it?

  • Does it need to expire? – schroeder Jun 6 '17 at 13:55
  • I think that a token have to expire, but I do not sure – gonisimchuk Jun 6 '17 at 14:23

Yes tokenisation does expire, either by date, or by the payment provider invalidating it.

Credit card expiry is usually set for each token and has a pre-set expiry date of 48 months in the case of MasterCard (although payment providers can adjust this), which is a sliding scale and reset during each token use. The token is unique to the card number not the transaction.

It should also be obvious that a card that expires (expiry date met) within that time will naturally expire therefore before tokenisation expiry.

While I know the OP didn't ask, to help others with tokenisation I have added the below for fullness:

The Tokenisation Process

The token is created by the payment provider (the company actually taking the payment) and returned to the merchant (e.g. could be the online shop). The merchant stores this token and replays it back to the payment provider as proof they are allowed to process money on behalf of that card. The payment provider stores the original PAN number (card number) and will only accept the token from authorised calls to use it. The payment provider may well have the PAN stored within a valut that can only be accessed (decrypted) using the authorised users password (e.g. could be an API key). This mitigates an attacker stealing the token and being able to use it. The payment provider can also invalidate the token from their end at any point.

More details here: http://www.mastercard.com/gateway/implementation_guides/Tokenization.html

  • but is this a PCI-DSS requirement or MC's implementation? – schroeder Jun 6 '17 at 15:26
  • Its not a requirement within the PCI-DSS, but I read the question more as in clarifying the time of tokenisation expiration. The point of the tokenisation (as I am sure you know) is to lower the scope of the PCI-DSS requirements, but care needs to be taken that the payment provider used is therefore PCI-DSS compliant to the level required as you are in essence transfer the responsibility of card data storage to them. – ISMSDEV Jun 6 '17 at 15:46
  • @schroeder - Tried improving the answer. Hopefully it's a little more clear now. – ISMSDEV Jun 6 '17 at 16:08
  • I don't think this answer is particularly useful. I think the usage of tokens is fairly clear already, and this answer only says that one implementation of a payment gateway (MasterCard's payment gateway) has a 48 month expiry. This is a payment gateway specific period though, not an industry or compliance standard – PaulG Jun 6 '17 at 16:12
  • But the OP asked if it has an expiry date - My answer indicates it does, and that it is different between providers, its commonly on a sliding scale and that the expiry can also be invoked from the payment providers end to invalidate if needed. So why is it not helpful? – ISMSDEV Jun 6 '17 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.