Abstract: A card transaction is processed at a merchant with a token in lieu of a card number (PAN) placed in an authorization message sent to a transaction processing system. The token is obtained from a tokenization service with alphanumeric characters that are not usable as the PAN in the event the merchant's system is breached. A transaction processing system receives the authorization message from the merchant and determines whether a token is present. If present, the transaction processing system requests a PAN from the tokenization service and replaces the token with the PAN.