Network Tokens for Subscriptions: What They Are and Why Approvals Rise

Every subscription business stores card details, and every year a large share of those cards change underneath it. When Stripe expanded network tokens to 36 more markets in February 2023, it noted that about 40% of cardholders had replaced their cards in the previous year because of expiry, loss or fraud. Each of those replacements is a renewal that can fail even though the customer never meant to leave.

Network tokens are the card networks' answer to that problem, and in 2026 they are also becoming a pricing question. Visa and Mastercard now charge more for card-not-present payments that are neither tokenized nor authenticated in some regions, and reward tokenized ones in others. If you run subscriptions, tokens affect your approval rate, your fees and how easily you can move cards between gateways.

This guide covers what a network token is, how it compares with stored card numbers and account updaters, what the published numbers prove, and what to ask your gateway.

Key takeaways

• A network token is a substitute card number issued by Visa, Mastercard or Amex for one specific merchant or token requestor. The network keeps it linked to the real card, so a reissued card usually doesn't break the token.
• Visa reports 4.6% higher authorization rates on card-not-present payments with tokens than with card numbers (VisaNet, Oct–Dec 2022) and 28% less fraud. Treat these as network averages, not a promise for your renewals.
• Tokens fix one kind of decline: stale or replaced credentials. They do nothing for insufficient funds, closed accounts or customers who want to cancel.
• Run tokens and a card account updater together. Token lifecycle updates depend on the issuer taking part; the updater covers cards that have no live token.
• Most brands get tokens through their gateway, which requests them on their behalf. That is convenient, but the tokens and their lifecycle updates usually stay with that gateway. Ask about portability before you need it.
• Fees are moving toward tokens: Visa's Europe fee of 0.075% on purchases with neither a network token nor 3DS has applied since 1 October 2025, and Mastercard's European fee for non-tokenized card-on-file payments is renamed and repriced from January 2027.

What is a network token?

A network token is a 16-digit number that stands in for the card's real number (the PAN). The card network (Visa Token Service, Mastercard Digital Enablement Service or American Express) creates it at the request of a token requestor: a merchant, a payment service provider or a token vault acting for the merchant. The token only works in that requestor's domain, so a token stolen from your database is useless at another store.

Three things make it different from the token your gateway gives you when you save a card:

• It is issued by the network, not the gateway. A gateway token (for example a Stripe pm_ ID) is a pointer to a card number stored in that gateway's vault. A network token is a real payment credential that issuers recognise.
• It has a lifecycle. When the issuer reissues a card, updates the expiry or closes the account, it tells the network, and the network updates or suspends the token. Your stored reference stays the same.
• It can carry a cryptogram. Customer-initiated payments with a token usually include a one-time cryptogram (for Visa, the TAVV). Stripe notes that fetching it can add latency, which it says it has optimised to keep small. For later merchant-initiated renewals, Adyen's documentation has you send the network transaction reference from the first payment.

Adoption is already large. Visa said it had issued 10 billion tokens by June 2024, ten years after launch. Mastercard said in June 2024 that tokens secured 25% of all ecommerce transactions globally, and committed to 100% ecommerce tokenization in Europe by 2030.

Network token vs stored card vs card account updater

Network tokens and account updaters are often sold as the same thing. They solve the same problem, a card that changed, but in different ways. Card account updater services (Visa Account Updater, Mastercard Automatic Billing Updater) let you or your provider ask the network whether a stored card number has a newer version. A token never needs asking, because the network changes what the token points to.

The practical answer is to use both. PCI Proxy's July 2026 guide recommends token lifecycle management as the primary mechanism and the account updater as a fallback, because issuer participation in token lifecycle updates varies by market. It is strongest in the US, Europe and major Asia-Pacific markets. We launched Card Account Updater in Paysight in September 2026 for exactly that fallback: cards that reach a renewal without a working token.

Why approval rates go up

For a subscription, the lift comes from two places, and a third reason to care sits on your processing statement.

1. Fewer stale-credential declines

This is the biggest effect for renewals. An expired or replaced card returns declines like Visa 54 (expired card) or a Mastercard Merchant Advice Code 01 (new account information available). With a live token, many of those renewals never decline at all. In our guide to soft vs hard declines, these are the "fix the data" declines; tokens fix the data before you charge.

2. More issuer confidence

A token tells the issuer the credential was provisioned for this business and hasn't been copied from a breach. The initial payment carries a cryptogram, and later renewals reference that first transaction. Issuers approve more of these payments because they see less fraud on them: Visa reports 28% lower fraud on tokenized card-not-present payments (VisaNet, FY2019 Q4 vs FY2020 Q4), and 58% lower fraud than card numbers in a comparison of global FY2022 data.

The third reason is cost: networks now price the difference between tokenized and non-tokenized payments (see the fee section below).

What the published numbers say

Almost every token statistic comes from a network or a processor, measured across all card-not-present payments, usually on first attempts. Use them to size the opportunity, not to forecast your result.

Three reasons your number will differ:

• Your decline mix. If most of your renewal declines are insufficient funds, tokens move little. If many are expired or replaced cards, they move a lot.
• Your card mix. Lifecycle coverage depends on issuers. A US-heavy book benefits more than one with many cards from low-participation markets.
• What you had before. If your gateway already runs an account updater, part of the token benefit is already in your baseline. In Stripe's February 2023 announcement of network tokens and card account updater, subscription company Doist said Stripe's tools had increased its subscription authorization rates by more than 4%.

Before you switch on tokens, split your renewal declines by reason code for the last 90 days. The share that is expired card, invalid account or "new account information" is roughly the ceiling of what tokens can recover.

2026 fees: why tokens are becoming a cost question

For years the networks provided tokens to brands free. That is changing in both directions: some fees now penalise card-not-present payments without tokens, and some programmes reward tokenized ones. Fee schedules vary by acquirer and region, so confirm with your provider which of these apply to you.

None of these fees is large on its own, but together they make raw card numbers the more expensive way to bill a renewal in Europe.

Network tokens and multiple gateways: the portability question

This is the part most token guides skip, and it matters most to brands that run more than one gateway or MID.

Every network token belongs to a token requestor, identified by a Token Requestor ID (TRID). PCI Proxy's August 2026 guide describes two common set-ups:

• The provider requests tokens on your behalf. This is how most brands get tokens: Stripe, for example, "will request tokens on your behalf". The network assigns a TRID for you, but the provider holds the keys and the token mapping.
• You (or a vault you control) are the token requestor. You hold the relationship with each network, and lifecycle updates come to you, whichever gateway processes the payment.

The difference shows up when you add or leave a gateway. An existing token can still be authorized through another acquirer, but the right to refresh it, receive lifecycle updates and provision new tokens stays with the requestor. If the requestor is your old provider, the new provider usually has to request fresh tokens, and for that it needs the card numbers. Adyen's documentation states the limit plainly: its network tokenization "is only applicable for payments acquired by Adyen", although it can forward tokens to a PCI-compliant third party and accept tokens you already hold.

Two rules keep this simple. Make sure you can always export your card numbers from whichever vault holds them, so a new provider can tokenize your base. And add gateways for redundancy and approval rates, never to spread chargebacks or fraud across accounts. Our guide to recurring billing across multiple payment gateways covers the vault side in more detail.

What tokens don't fix

• Insufficient funds. The token is valid; the account is empty. That is a retry-timing problem.
• Closed or blocked accounts. When the issuer closes the account, the token is suspended or deleted and the renewal declines. Ask the customer for a new card.
• Token errors. Mastercard's Merchant Advice Code 04 means "token requirements not fulfilled for this token type". TabaPay's guidance is to ask for a different payment method rather than retry.
• Customers who want to leave. A token keeps a card working; it doesn't prevent a cancellation or a dispute.

Questions to ask your gateway before you switch tokens on

A rollout plan for subscription brands

1. Baseline. Pull 90 days of renewal declines by reason code and card network. Note the share of expired, replaced and "new account information" declines.
2. Enable tokens at each gateway and confirm the existing card-on-file base is being tokenized, not only new checkouts.
3. Keep the account updater on for cards that don't get a token or whose issuer doesn't send lifecycle updates.
4. Measure for two billing cycles. Compare first-attempt renewal approvals for token and card-number payments, by network.
5. Handle token declines on purpose. Treat MAC 04 and token-suspended responses as "ask the customer", not "retry".
6. Review fees quarterly. Check your processor statements for SCF, Digital Commerce Service Fee and DCAP lines, and how much tokenized volume qualifies.

Where Paysight fits

Paysight is a platform to launch and manage subscriptions on your own payment stack. It isn't a processor, and it doesn't replace your gateway's tokenization. You connect your gateways and merchant accounts (Stripe, NMI, Finix or your own MIDs), and network tokens come from those gateways, for example from Stripe requesting them on your behalf.

Where Paysight helps is around the tokens:

• One view of subscription, transaction and customer data, so you can see renewal approvals and decline reasons per gateway and card network, and measure what tokens changed.
• Card Account Updater for cards that reach a renewal without a working token, charged per card actually updated.
• Retries and routing across the gateways you connect, so a renewal that fails for a processing reason can go to another route, while hard declines go to the customer.
• Customer care portals where subscribers look up a charge, request a refund or cancel with you, which covers the part tokens can't: customers who want to leave.

Sources

• Stripe: Stripe expands network tokens and card account updater to improve conversion (Feb 2023)
• Stripe: Understanding the benefits of network tokens (accessed Oct 2026)
• Visa Acceptance: Token Management Service, 4.6% authorization and 28% fraud figures (accessed Oct 2026)
• Visa Acceptance UK: 8% authorization uplift in Europe (accessed Oct 2026)
• Visa: Visa tokens bring USD2 billion uplift to digital commerce in Asia Pacific (Mar 2024)
• Digital Transactions: Visa marks 10 billion tokens (Jun 2024)
• Payments Dive: Visa, Mastercard push more tokenization (Sep 2025)
• Mastercard: commits to 100% ecommerce tokenization by 2030 in Europe (Jun 2024)
• Mastercard: Network tokenization, Checkout.com 10.3 ppt figure (accessed Oct 2026)
• Adyen Docs: Network tokenization (accessed Oct 2026)
• PCI Proxy: What is a TRID? (Aug 2026)
• PCI Proxy: Network token lifecycle management (Jul 2026)
• Checkout.com: Visa Secure Credential Framework fee increase in Europe (Aug 2025)
• CMSPI: April 2026 U.S. network fee updates (Apr 2026)
• VGS: Visa's Digital Commerce Authentication Program (Apr 2026)
• PayPal Braintree: Card network updates, Fall 2026 release guide
• TabaPay: Mastercard Merchant Advice Codes (accessed Oct 2026)