Dotifi.com – How are tokens generated in banking payments on hardware devices are they stored already

by admin

Oct 16, 2026

adng

5 min read 865 words 38 views

How Payment Tokens Are Generated in Banking Hardware: Pre-Stored or Generated on the Fly?
By Dotifi.com Tech Editorial Team | October 16, 2026

In modern digital banking, tapping a phone or inserting a hardware security key feels instantaneous. But beneath that seamless experience lies a sophisticated cryptographic ballet. A common question among security engineers and fintech developers is: How are payment tokens generated on hardware devices, and are they already stored, or created on the fly?

The short answer is a hybrid: The payment token itself is pre-generated and securely stored in the hardware, but a unique, dynamic cryptogram is generated on the fly for every single transaction.

Here is a deep dive into the architecture, generation, and storage of payment tokens in banking hardware.

1. The Core Concept: What Is a Payment Token?

Payment tokenization is the process of replacing a sensitive Primary Account Number (PAN) with a unique, randomized surrogate value known as a token

www.europeanpaymentscouncil.eu

. Unlike a static card number, a payment token has no usable value outside of its specific, authorized context

solidgate.com

. These network tokens are typically generated and managed by card schemes like Visa (via Visa Token Service) or Mastercard (via MDES)

www.aciworldwide.com

2. Phase One: Pre-Generation and Provisioning (The “Stored” Part)

Contrary to popular belief, the hardware device (like a smartphone’s Secure Element or a dedicated banking key fob) does not generate the payment token itself.

Token Request: When a user adds a card to a digital wallet or a hardware device, the device sends a provisioning request to the bank.
TSP Generation: The bank forwards this to a Token Service Provider (TSP). The TSP is responsible for payment token generation and managing the token’s lifecycle

www.royalholloway.ac.uk

.
HSM Protection: On the backend, this generation is anchored by Hardware Security Modules (HSMs). An HSM is a tamper-resistant physical device that generates and protects the cryptographic key material used to create and map these tokens

energizeglobal.com

.
Secure Storage: Once generated, this network token is pushed down and pre-provisioned (stored) inside the device’s Secure Element (SE) or Trusted Execution Environment (TEE)

www.royalholloway.ac.uk

.

At this stage, the token is statically stored on the hardware, bound specifically to that device’s unique identifier.

3. Phase Two: On-the-Fly Generation (The “Dynamic” Part)

If the token is already stored, why can’t a hacker simply extract it and replay the transaction? Because the hardware device never transmits the static token alone.

When a payment is initiated (e.g., an NFC tap at a point-of-sale terminal), the hardware device performs a real-time cryptographic operation:

The Secure Element takes the pre-stored network token.
It combines it with transaction-specific data (such as a terminal challenge, timestamp, or an internal transaction counter).
It then generates a dynamic cryptogram (and often a dynamic CVV) on the fly

medium.com

.

This cryptogram is a layer of security dynamically created for each transaction using the EMV payment token

www.bostonfed.org

. Because the cryptogram is unique to that exact millisecond and terminal, it cannot be reused or replayed by attackers

applemagazine.com

4. Hardware Architectures Involved

The execution of this hybrid model relies on robust hardware isolation:

Secure Element (SE): A dedicated, tamper-resistant microprocessor chip (common in Apple Pay, Google Wallet, and physical EMV chips) that stores the pre-provisioned token and executes the on-the-fly cryptogram generation

docs.dennisokeeffe.com

.
Trusted Execution Environment (TEE): A secure area within the device’s main processor that isolates payment processes from the primary operating system, ensuring that even if the OS is compromised, the token and cryptogram generation remain protected

www.accc.gov.au

.
Dedicated Hardware Tokens: In corporate or high-security banking, physical RSA-style or smartcard hardware tokens use embedded cryptographic engines to generate one-time passwords (OTPs) or transaction signing cryptograms dynamically, using pre-loaded seed keys stored in the device’s non-volatile memory.

5. Why This Hybrid Approach Dominates Banking Security

This “pre-stored token + dynamic cryptogram” model solves multiple security challenges simultaneously:

Device Binding: Device tokenization binds the digital credential to specific hardware, meaning a stolen token cannot be used on a different device

razorpay.com

.
Fraud Mitigation: Even if a merchant’s database is breached, the intercepted data is just a single-use cryptogram and a device-restricted token, rendering it useless for future fraud

corporate.visa.com

.
Regulatory Compliance: By ensuring the actual PAN never touches the merchant’s environment or the device’s main memory, banks and fintechs drastically reduce their PCI-DSS compliance scope

en.wikipedia.org

.

Conclusion

To summarize, banking hardware does not generate the core payment token from scratch during a transaction. Instead, the token is securely pre-generated by a network TSP, protected by backend HSMs, and stored in the device’s Secure Element. The true “on-the-fly” magic lies in the dynamic cryptogram, which the hardware generates in real-time to prove the transaction’s legitimacy without ever exposing the underlying token or real account number.

As hardware security continues to evolve, this layered approach of static provisioning paired with dynamic execution remains the gold standard for frictionless, fraud-resistant global payments.