Digital wallets and network tokenization
How a card becomes a stand-in number on your phone: pass-through versus staged wallets, device tokenisation, and the DPAN journey behind a tap.
IN ONE LINE
An everyday analogy: a digital wallet is a cardholder for cards.
When Maya Chen adds her Bank Alfa card to her phone, she is not copying the card into the phone — she is asking the card world for a stand-in number that only this phone may use.
From then on the phone pays with that stand-in, called a DPAN (a device account number), plus a fresh one-time code for each tap.
Two shapes of wallet exist.
A pass-through wallet simply presents that stand-in card to the shop, so the payment still runs on the card rails exactly as a plastic tap would.
A staged wallet first pulls money into an account of its own, then pays the shop separately — two steps, staged.
At Demo Coffee Ltd, Maya's tap is a pass-through wallet at work.
(SYNTHETIC / TRAINING ONLY — every person and firm named here is fictional.)
WHAT IT ACTUALLY IS
A digital wallet stores payment credentials on a device and presents them to pay.
The distinction that matters for how money moves is pass-through versus staged.
A pass-through wallet holds a network token — a DPAN issued through the card network under EMVCo's tokenisation specification and bound to one device — and presents it in a normal card authorisation; the wallet never holds the money, and the issuer authorises against the real PAN behind the token.
A staged wallet does two separate legs: it funds a stored balance, often by an account-funding-transaction, then makes its own payment to the merchant, so the merchant sees the wallet, not the card.
The wallet-provider is the party that runs the wallet and, for device wallets, acts as a token-requestor — the entity that asks the network's token service for a DPAN and vouches for the enrolling cardholder.
HOW IT WORKS
The practitioner's lens is where risk and data sit.
Device-tokenization binds the DPAN to a specific phone and to per-transaction cryptograms, so a token lifted from one device should not authorise from another — the domain controls are the defence, not secrecy of the number.
That moves the fraud problem to enrolment: the weak point of wallet provisioning is the identity check done when a card is first added, which is where issuers apply step-up strong-customer-authentication.
For a pass-through wallet, disputes, chargebacks and interchange behave as for any card payment, because it is a card payment; the wallet is a presentation layer.
For a staged wallet the picture differs: the card sees only the funding leg to the wallet, and the shop's real counterparty is the wallet operator, which changes who bears risk and who holds the customer's transaction data.
A blunt caution: 'tap to pay' hides all of this, so always ask which shape of wallet you are actually looking at.
THE WORDS
- Digital wallet
- An app or device feature that stores payment credentials and presents them to pay, either passing a card through or taking a staged step in between.
- Pass-through wallet
- A wallet that hands an underlying card credential — normally a device token — to the merchant, so the payment runs on the card rails as an ordinary card transaction.
- Staged wallet
- A wallet that pays the merchant from its own balance or funding source, then separately funds itself — splitting the payment into two stages the merchant does not see through.
- Device tokenisation
- Replacing a card's real number with a device-bound token (a DPAN) stored in the wallet, so the actual card number is never presented at payment time.
- Wallet provider
- The company that runs a digital wallet — provisioning credentials, authenticating the device or user, and, for staged wallets, holding the balance and moving funds.
- Account funding transaction (AFT)
- A card transaction whose purpose is to move money into an account or wallet, rather than to buy goods — the funding leg behind staged wallets and top-ups.
READ FIRST
CONNECTED TO
SOURCES
- PSD2 and the RTS on strong customer authentication and secure communication — European Banking Authority
- A glossary of terms used in payments and settlement systems — CPSS (now CPMI), Bank for International Settlements
- Payments Signal editorial teaching models — Payments Signal
Derived from Digital wallets and network tokenization. Every claim on this card is sourced on that page.