Hacker News Reader

From what you write and from the diagram in that pdf, it's the issuer bank that creates the device token, but then it's the network that does the reverse lookup. Do both the issuer bank and the network know the mapping between device tokens and cards?

View on HN

Yes. The network needs of course to map tokens back to PANs (Primary Account Numbers). Tokens are included in authorization requests to issuing banks, in addition to the actual payment details.

Also, both issuers and networks need to be able to suspend and unlink tokens in case of fraud or if the end user loses their device, which implies that they know individual device tokens.

Reply on news.ycombinator.com