Every time you tap your phone at a checkout, no one in that transaction — not the terminal, not the merchant, not even Google or Apple — ever sees your actual card number. That's not marketing. It's a deliberate engineering decision called tokenization, and it's the backbone of modern card payments.

The problem with card numbers

Your card number — the 16-digit string on the front — is called a PAN (Primary Account Number). It’s your identity in the card network. Present it with an expiry date and CVV, and in most cases that’s enough to charge your account.

That’s the problem. It’s a static credential. If it leaks — from a merchant database, a data breach, a skimmer — it’s immediately usable by anyone who gets it. Merchants have historically needed to store PANs to support recurring payments, saved cards, and subscription billing. Storing millions of PANs made them high-value targets.

Tokenization solves this by replacing the PAN with a token: a surrogate value that looks like a card number but means nothing on its own. The real PAN lives in a token vault — a locked mapping table. The merchant never touches the actual PAN again. The diagram below explains this in a high level manner.

Hight level flow of a merchant when storing and charging a card

Two kinds of tokens — and they're very different

This is where most explanations stop, but there’s a critical split you need to understand: gateway tokens and network tokens. They solve the same surface problem, but they live at completely different layers of the payments stack.

First, some context: gateways vs. networks

A payment gateway is the service that sits between a merchant and the card networks. When you check out on a website, the gateway handles the connection: it encrypts your card details, routes the transaction, and returns an approval or decline. Merchants don't connect directly to Mastercard or Visa — the gateway is the middleman. Examples: MPGS (Mastercard Payment Gateway Services) and Cybersource (owned by Visa/TSYS).

A card network (also called a scheme) is the rails the transaction actually travels on: Mastercard, Visa, Amex. They set the rules, connect issuing banks to acquiring banks, and move money between them. They also operate their own tokenization services.

Gateway tokens

A gateway token is created and managed entirely by the payment gateway. When a customer enters their card on checkout, the gateway intercepts it, generates a token, stores the PAN in its own vault, and hands the merchant a token string. From that point on, the merchant only ever stores and sends the token — the gateway does the vault lookup to retrieve the real PAN whenever a charge is needed.

The important limitation: gateway tokens are scoped to that gateway. If a merchant migrates to a different payment processor, every stored token becomes worthless. They'd need to run a card migration project to re-tokenize their customer base.

Network tokens

A network token is created and managed by the card network itself — Mastercard’s service is called MDES (Mastercard Digital Enablement Service), and Visa’s is VTS (Visa Token Service).

Unlike gateway tokens, network tokens are portable. They’re not tied to any single gateway — any processor that understands the network’s token format can work with them. The token maps back to the underlying PAN at the network level, not at a gateway’s vault.

There’s another powerful benefit: automatic lifecycle management. When a card expires, gets reissued after fraud, or changes numbers, the network can automatically update the token mapping. Merchants and wallets holding that token don’t need to do anything — it just keeps working. That’s not possible with gateway tokens.

Why bother with gateway tokens? (Yes, it’s about PCI)

If your business stores, processes, or transmits cardholder data — including PANs — you’re subject to PCI DSS (Payment Card Industry Data Security Standard). Compliance isn’t optional. It means quarterly vulnerability scans, annual audits, strict network segmentation, encryption requirements, access controls, and more. Scope scales with how much card data you touch.

Here’s the key: tokens are not cardholder data. A gateway token stored in your database doesn’t count as a PAN under PCI DSS. You’re still in scope, but your scope shrinks dramatically. No PAN, no breach risk, no multi-million dollar liability exposure if your database leaks.

Apple Pay and Google Pay

When you add your Mastercard to Apple Wallet, here’s what actually happens behind the scenes:

1. Apple sends your card details to Mastercard’s MDES (or Visa’s VTS for Visa cards)

2. The network verifies the card and issues a DPAN — a Device PAN — a network token tied specifically to your device

3. That DPAN is stored in your iPhone’s Secure Element (a dedicated hardware chip, isolated from the main processor) — or in Google’s cloud-based Host Card Emulation system for Android

4. Your real PAN is never stored on the device

When you tap to pay:

1. Your device generates a cryptogram — a one-time cryptographic code tied to that specific transaction

2. The terminal receives your DPAN + the cryptogram

3. That goes to the acquiring bank → card network → MDES/VTS validates the cryptogram and maps the DPAN back to your actual card → routes to your issuing bank

4. Your bank approves or declines

The cryptogram is the critical piece. As the name suggests, it uses asymmetric cryptography under the hood that has been exchanged between the scheme and the device. I won’t go into too technical but so you know, the cryptogram is single-use, bounded by the transaction details (amount, timestamp, ..etc).

This is why Apple Pay and Google Pay are considered more secure than tapping a physical card — your actual PAN never leaves your bank, and every tap generates a unique proof of authorization.

Putting it all together

The mental model: gateway tokens protect merchants from storing PANs. Network tokens give those protections portability and lifecycle management. Device tokens take it further — the PAN never touches the payment terminal at all, and every transaction requires fresh cryptographic proof from your device.

Conclusion

Thank you for reading all the way to this point, it has always at the back of my mind the question on how my card got stored on my phone, hopefully after this article, we roughly understand it. I will see you guys in the next article, bye for now!

1. The Merchant Service Fee (MSF): Who Gets a Cut?

Every time a customer pays by card, the merchant does not receive the full transaction amount. A series of small fees — collectively called the Merchant Service Fee (MSF) — are deducted before the money is settled to the merchant’s account.

The Four Parties in a Standard Card Transaction

• The customer (cardholder) — taps or inserts their card.

• The issuer bank — the bank that issued the card to the customer (e.g. CommBank, ANZ, Westpac, NAB). It authorises the transaction and carries fraud risk.

• The acquirer bank/Payment processor — the merchant’s bank or payment processor (e.g. Westpac, NAB, or a third-party processor like Tyro). It receives the payment request and settles funds to the merchant.

• The card scheme — the network that connects issuers and acquirers and sets the rules (eftpos Australia, Visa, Mastercard, Amex).

Breaking Down the MSF

Interchange fee: Paid by the acquirer (merchant’s bank) to the issuer (customer’s bank) for every transaction. This is the largest component. It compensates the issuer for fraud risk, card issuance costs, and providing credit. For debit cards via the domestic eftpos network, the RBA caps this at an average of 8 cents per transaction, with a ceiling of 10 cents or 0.2%. For credit cards, the cap is 0.50% on average with a ceiling of 0.80% per transaction (RBA, 2024).

Thanks for reading! Subscribe for free to receive new posts and support my work.

Scheme fee: Charged by the card scheme (e.g. Visa, Mastercard, or eftpos/AP+) to both the acquirer and the issuer for using their network infrastructure. These fees are not directly regulated by the RBA, making them harder for merchants to scrutinise. They vary by transaction volume, network, and card type.

Acquirer margin: What the payment processor or acquirer bank charges the merchant on top of the above costs, as their profit margin for facilitating the payment.

Payment orchestrator fee (if applicable): If a merchant uses a third-party payment platform such as Stripe, Square, or Tyro, an additional layer of fees applies. These providers typically offer blended (flat) rates or interchange-plus pricing. For example, Stripe charges 1.7% + 30¢ for domestic cards in Australia (Stripe, 2024); Tyro charges a flat 1.4% for in-person contactless transactions. This fee bundles interchange, scheme, and margin into one number.

Sources: RBA Backgrounder on Interchange and Scheme Fees (October 2024); Stripe Australia pricing (2024); Mobile Transaction AU merchant fee guide (December 2024); NAB merchant fee guide (2024).

Routing Matters: Least Cost Routing (LCR)

Most Australian debit cards — including those issued by the big four banks — are dual-network cards. This means a single card carries both the domestic eftpos scheme and an international scheme (Visa Debit or Debit Mastercard) on the same chip. When tapped at a terminal, the payment can travel over either network.

Historically, terminals defaulted to routing via Visa or Mastercard — which are more expensive for merchants. Merchants were often unaware this was happening.

Least Cost Routing (LCR) — also called Merchant Choice Routing (MCR) — allows the merchant’s terminal to automatically choose the cheapest available network. Since eftpos fees are on average 40% lower than international scheme fees for debit transactions (AP+, 2024), enabling LCR meaningfully reduces merchant costs

2. Why Do Card Payers Sometimes Pay a Surcharge?

When a customer pays by card, the merchant effectively receives the sale amount minus the MSF. Over thousands of transactions, this is a significant business cost.

Rather than absorbing this cost (and spreading it across all customers through higher prices), a merchant can choose to pass the card processing cost directly to the card-paying customer via a surcharge. This is called cost pass-through.

Is It Legal?

Yes — and the RBA has encouraged it as a matter of payments policy since 2003. The rationale: if card costs are invisible to consumers, there is no incentive to use cheaper payment methods, and no competitive pressure on banks and networks to reduce fees. By surfacing the cost, surcharging provides a price signal.

However, merchants are strictly limited. Under Australian Consumer Law (enforced by the ACCC), a surcharge can only recover the merchant’s actual cost of acceptance for that card type. Merchants cannot profit from surcharges. Excessive surcharging is illegal. Despite this, the ACCC received over 2,500 complaints about excessive surcharges in the 18 months to June 2024 — many businesses charge a flat 1.5–1.9% for all cards, even when their actual eftpos acceptance cost is under 0.3% (ACCC, 2024).

What Are Typical Surcharges?

Based on actual merchant acceptance costs and common practice in Australia (2024):

• eftpos (domestic debit): Often 0% — many merchants don’t surcharge eftpos. Maximum reasonable: ~0.2–0.5%.

• Visa/Mastercard debit: ~0.3–0.8%

• Visa/Mastercard credit: ~0.5–1.5%

American Express: ~1.5–2.0%+. Many smaller merchants simply do not accept Amex.

3. The 2026 RBA Reform Package

On 1 April 2026, the RBA’s Payments System Board released its Review of Merchant Card Payment Costs and Surcharging — Conclusions Paper, confirming a major reform package.

Summaries of the paper are the following:

Surcharge ban (effective 1 October 2026):

• Surcharges on eftpos, Visa, and Mastercard debit, prepaid, and credit card payments will be completely banned.

• The advertised price will be the final price paid — no post-tap surprise fees.

Lower interchange fee caps (effective 1 October 2026):

• Domestic credit card and Debit card interchange cap reduced

• Small businesses — which typically pay closer to the cap than large retailers — benefit the most.

Fee transparency (effective 1 October 2026):

• Card networks and large acquirers must publish standardised, comparable fee information.

• Merchants gain the tools to shop around between payment providers.

What This Means for Each Party:

• Customer: No more surcharge on eftpos/Visa/MC from 1 Oct 2026; advertised price = final price

• Merchant: Cannot surcharge; must absorb MSF or raise prices.

• Issuer bank: Receives lower interchange on debit and credit.

• Acquirer bank / processor: Pays lower interchange to issuers. Required to publish standardised fee information.

• Schemes (Visa/MC/eftpos): Must publish transparent, standardised pricing.

The Hidden Catch: Costs Don’t Disappear — They Move

The ban removes the surcharge line from your receipt. It does not remove the underlying cost of accepting cards. For merchants who currently surcharge, that cost has to go somewhere:

• Most will embed it into base prices — your $5.00 coffee becomes $5.15 regardless of how you pay.

• Cash customers, who were previously shielded from card costs, will now effectively subsidise card users through higher prices.

Final words

Australia’s card payment system involves multiple parties each taking a slice of every transaction. The merchant bears the visible cost; the customer bears it indirectly through surcharges or baked-in prices. The eftpos domestic network is the cheapest option for debit, Amex is the most expensive and least regulated, and Visa/Mastercard sit in the middle.

From October 2026, the landscape changes significantly: surcharges on the three major networks disappear, interchange caps come down, and fee transparency increases. The overall goal is a more efficient, fairer payments system — though the costs will be redistributed rather than eliminated.

Sources & References

1. RBA — Backgrounder on Interchange and Scheme Fees (October 2024): https://www.rba.gov.au/payments-and-infrastructure/review-of-retail-payments-regulation/backgrounders/backgrounder-on-interchange-and-scheme-fees.html

2. RBA — Review of Merchant Card Payment Costs and Surcharging, Conclusions Paper (1 April 2026)

3. Australian Payments Plus (AP+) — eftpos scheme fee reduction announcement (May 2025): https://www.auspayplus.com.au/ap-lowers-eftpos-scheme-fees-in-ongoing-commitment-to-lowering-cost-of-payments

4. AP+ — Merchant Choice Routing mobile wallet rollout (September 2024): https://www.auspayplus.com.au/rollout-of-merchant-choice-routing-for-mobile-devices

5. Stripe — EFTPOS Fees and Charges in Australia (January 2026): https://stripe.com/resources/more/eftpos-fees-and-charges-in-australia

6. Mobile Transaction AU — Merchant fees and costs of accepting card payments (December 2024): https://www.mobiletransaction.org/au/merchant-fees-cost-of-accepting-card-payments/

7. NAB — Understanding merchant fees and EFTPOS machine costs (2024): https://www.nab.com.au/business/payments-and-merchants/merchant-support-centre/understanding-merchant-fees

8. ACCC — Excessive surcharging enforcement priority (2024–2025)

9. SBS News — Card surcharge ban timeline explained (1 April 2026): https://www.sbs.com.au/news/article/australia-card-surcharge-ban

10. Australian Frequent Flyer — RBA Changes 2026 Explained (1 April 2026): https://www.australianfrequentflyer.com.au/rba-changes-2026/