 When a payment card authorization request is made to verify the legitimacy of a transaction, a token might be returned to the merchant instead of the card number, along with the authorization code for the transaction.The token is stored in the receiving system while the actual cardholder data is mapped to the token in a secure tokenization system.Storage of tokens and payment card data must comply with current PCI standards, including the use of strong cryptography.