"Remember my card" features feel like a small convenience, but the security question behind them is a real one: where does that card data actually live once you click save?
What actually gets stored
When tokenization is used correctly, the merchant never stores your card number at all. Instead, the card network or payment provider exchanges it for a token — a reference string that's meaningless outside their own systems — and it's that token, not your card number, that gets saved against your customer profile.
How a token is different from your card number
A stolen token is useless anywhere else — it doesn't work at a different merchant, and it can't be reverse-engineered back into the original card number. That's the entire point: even if a merchant's database were breached, there would be no real card data in it to steal.
What happens when a customer checks out again
On a future purchase, the merchant sends the stored token back to the provider instead of asking for card details again. The provider looks up the real card behind that token and processes the payment exactly as if the number had been re-entered — the customer just never has to.
Key takeaways
- Tokenization replaces the real card number with a reference that's useless if stolen.
- The merchant's systems typically never store — or even see — the real card number after the first entry.
- A breach of the merchant's database doesn't expose usable card data.
- The convenience of one-click repeat purchases and the security improvement are the same mechanism, not a trade-off.