Merchant Link SecurityCents

by Tim Kinsella

August is that time of year when it seems like everyone is on vacation. Next week I’m actually headed to a dude ranch with my wife and our three boys. Yee-Ha! It should be a blast.

So given that we’re in peak vacation season, coupled with buzz around the recent finding that 38 percent of all credit card hacking cases involve the hotel industry, we’re seeing more stories in the consumer media with tips to ensure your credit card data is safe when you travel. One recent article advised consumers to “ask the hotel if they have tokenization.”

So here’s a quick pop quiz:

1. True or false? Tokenization encrypts your credit card number.
2. True or false? Encryption is used to create tokens.

False and False. This is what drives me nuts! Tokenization and encryption are two different things. There are a lot of inaccuracies out there and it’s important to understand the difference, as well as the strengths and limitations of both.

Tokenization is the replacement of a data element (such as a credit card number) with another data element which serves as a reference to the original. This replacement data element is also known as a token. This token/reference number is stored in a hotel’s computer system instead of the real credit card number so that if someone tries to steal the credit card number, all they end up with is a non-actionable token that has no value. The value of a token is that it cannot be decrypted, derived, cracked or reverse engineered to discover the original value.

Encryption on the other hand, is the process of transforming a data element using an algorithm to make it unreadable to anyone except those who possess the decryption key.

While both have their place, tokenization is more effective at securing data, as encrypted data is dependent on the strength of the decryption as well as how well the decryption key is managed. The best security strategy is a layered one, and so we recommend that merchants employ both tokenization (to secure data at rest) and encryption (to secure data in-flight).

Still confused? Ask us a question or share your thoughts below.