Network Tokens for iGaming Payments Explained

An operator once told me the single most profitable change they made in a year wasn't a new acquirer or a cheaper rate. It was flipping one switch with their existing PSP: network tokens. Deposits that used to fail on expired cards started going through, and nobody had to touch the checkout.

Network tokens are one of the few approval-rate levers that cost the player nothing and add no friction. The card number stored on file gets replaced with a scheme-issued token that banks trust more and that never goes stale.

This guide covers what a network token is, how it moves through the payment flow, why it lifts iGaming approval rates, and how it differs from the vault tokens your PSP may already use. Facts verified as of August 2026.

What is a network token?

A network token is a substitute card credential issued by the card scheme itself, Visa or Mastercard, that replaces the real 16-digit card number in stored-card and recurring payments. It works like the card number but is restricted to a specific merchant or use case.

Term: network token. Definition: A scheme-issued replacement for a card's primary account number (PAN), provisioned through services like Visa Token Service or Mastercard MDES, and usable only within a defined domain such as one merchant.

The standard behind it is the EMV Payment Tokenisation Specification, maintained by EMVCo, the body jointly owned by the major card schemes. It sets out how a token is issued, provisioned and processed so it can travel from the merchant, through the acquirer, across the network, to the issuing bank for authorisation, all without exposing the underlying card number.

The important word is scheme-issued. The token doesn't just mean something to your processor. It's understood by the whole payment chain, and the bank on the other end knows exactly what it is.

How do network tokens work?

When a card is tokenised, the scheme's token vault stores the mapping between the real card number and the token, then hands the merchant a token to use in future transactions. Each payment also carries a one-time cryptogram that proves the token is being used legitimately.

Two services do the heavy lifting. Visa runs Visa Token Service (VTS), and Mastercard runs the Mastercard Digital Enablement Service (MDES). Both replace the PAN with a token, both generate the cryptogram, and both keep the token in sync with the real card.

That last point is where the money is. When a player's bank reissues a card, new number, new expiry, after a loss, theft or routine renewal, the scheme updates the token behind the scenes. The operator keeps charging the same token, and the deposit that would have failed on the old card number now succeeds. No email to the player, no re-entry, no dropped subscription-style deposit.

A network token is also domain-restricted. Provision it for your casino and it can't be lifted and used somewhere else. Combined with the per-transaction cryptogram, a stolen token is close to useless, which is why issuers treat it as a stronger signal than a raw card number.

Do network tokens improve approval rates for iGaming?

Yes, and the uplift is well documented. Issuers approve tokenised transactions more often because the scheme pre-validates the token before the authorisation reaches the bank, which is a cleaner signal than a keyed-in card number carries.

Visa reports that its network tokens lift card-not-present authorisation rates by around 4.6% globally versus the underlying card number, and Mastercard has cited roughly 2.1%. In its 2024 milestone announcement, Visa said it had issued more than 10 billion tokens since launching the technology in 2014, generating an estimated 40 billion US dollars in incremental e-commerce and saving 650 million dollars in fraud in a single year.

For a deposit-heavy business, a few points of approval uplift is real revenue, not rounding. iGaming runs high transaction frequency with returning players, so the compounding effect of tokenised cards on file is larger here than in most retail. You can model what an approval-rate improvement is worth to your book with our approval rate calculator.

One honest caveat: the headline uplift figures are scheme averages across all verticals. Your own gain depends on how many stale cards you carry and how your PSP applies tokenisation. The direction is never in doubt, but the exact number is worth measuring on your own traffic rather than assuming the scheme average.

Network tokens vs card-on-file: what's the difference?

Card-on-file means the merchant has stored a credential to charge again. Network tokenisation is a way of storing that credential more safely and effectively. They aren't rivals, one is the method, the other is the improvement.

A traditional card-on-file setup stores either the real PAN, with all the compliance weight that carries, or a proprietary vault token that only your PSP understands. A vault token keeps the card number out of your systems, which is good for security, but it does nothing for approval rates and it goes stale the moment the bank reissues the card.

A network token fixes both problems at once. It keeps the card number out of your systems and it stays current and carries a stronger authorisation signal. The cleanest setup for an operator is card-on-file backed by network tokens, so stored deposits keep working and keep getting approved.

Why do network tokens matter for gambling operators specifically?

Because iGaming lives on returning deposits from stored cards, and every one of those cards is a ticking clock. Cards get lost, stolen and reissued constantly, and a gambling operator with thousands of saved cards feels every reissue as a failed deposit.

Gambling also carries harder issuer scrutiny than mainstream retail. Transactions coded to the gambling category, MCC 7995, already face more cautious banks, so anything that strengthens the authorisation signal matters more here than it would for a clothing retailer. A network token gives a nervous issuer a reason to lean towards yes.

There's a fraud angle too. iGaming attracts card-testing and stolen-card attacks, and a domain-restricted token with a one-time cryptogram is much harder to abuse than a card number sitting in a database. It won't replace your fraud stack, but it removes one of the softer targets.

What's the difference between Visa Token Service and Mastercard MDES?

Very little in principle, and the difference that matters is coverage. Both implement the EMVCo framework, both replace the PAN with a domain-restricted token, and both keep it updated when the card changes. The practical question is whether your PSP supports both across the schemes you accept.

Visa Token Service and MDES are scheme-specific, so a Visa card is tokenised through VTS and a Mastercard through MDES. An operator wants both switched on, because leaving one scheme untokenised means half the book keeps failing on reissued cards. This is a PSP configuration question, not a card scheme limitation.

Where implementations differ is in the extras, how account updater services are bundled, how tokens are provisioned in bulk, and what reporting you get back. Those are worth asking your provider about directly. The iGamingPayments.ai directory lists PSPs and acquirers by region and vertical, including which ones support network tokenisation across both schemes.

Frequently asked questions

Do network tokens work for gambling merchants?

Yes, wherever the PSP supports them for your card schemes. Network tokens apply to card-not-present transactions regardless of vertical, and they're especially useful for iGaming because deposits come from returning players whose stored cards would otherwise fail once the bank reissues them.

Are network tokens the same as the tokens my PSP already uses?

Usually not. Most PSPs use a proprietary vault token that only means something inside their own systems. A network token is issued by Visa or Mastercard, understood across the whole payment chain, and updates automatically when the underlying card changes. The two often sit side by side, with the vault token as your reference and the network token as what actually gets charged.

Do network tokens cost extra?

Some PSPs charge a small per-token or per-transaction fee for network tokenisation, others include it. Even where there's a fee, the approval uplift on a deposit-heavy book usually pays for it many times over, because one recovered deposit is worth far more than the cost of the token.

Is a network token safe if it leaks?

Safer than a card number, yes. A network token is domain-restricted, so a token provisioned for one merchant can't be used at another, and card-not-present transactions carry a one-time cryptogram that can't be replayed. A leaked token is far less useful to a fraudster than a leaked PAN.

Do network tokens replace 3D Secure?

No. Network tokens secure the stored credential and improve the authorisation signal, while 3D Secure authenticates the cardholder at checkout. They solve different problems and work together, and both feed the risk data an issuer sees when it decides whether to approve a deposit.

Can I move my stored cards to network tokens without asking players to re-enter them?

Yes. Tokenising an existing card-on-file is a background process run through the PSP and the scheme token service. Players keep depositing with the card already saved, and nothing changes in the checkout they see. It's one of the reasons this is such a low-friction change to make.

Where can I check if a provider supports network tokens?

Ask the PSP directly whether they support Visa Token Service and Mastercard MDES across the schemes you accept, and whether an account updater is bundled. The payments glossary defines the surrounding terms, and the directory flags providers by capability and region.

Find the right payment provider for your operation

Browse 342+ vetted PSPs, crypto processors, open banking providers and fraud vendors - filtered by region, vertical and payment method. Or run the numbers before your next PSP negotiation.