Tokenization—replacing a sensitive cardholder number with a nonsensitive token­—first made its way into the payment card industry on the issuing side in 2000 with the launch of proprietary technology from Ireland-based Orbiscom. Allied Irish Bank was the first issuer. Mastercard bought Orbiscom in 2009. U.S.-based merchant processor Shift4 was first to use tokenization on the acquiring side in 2005. Shift4 used tokens with merchants that wanted to store cardholder information. Both of these programs predated EMVCo Tokenization Standards, which were not established until March 2014. ...