Tapping “add card” does more than copy a card number into a phone. In a tokenized mobile wallet, the request moves through eligibility, identity and risk checks before a restricted payment credential is created for that wallet or device.
Enrollment identifies the card and the requested wallet
A cardholder can begin in a wallet application or, when supported, from an authenticated issuer application. The person scans or enters card details or selects an eligible card already associated with the issuer relationship.
The request includes context such as the wallet, device and account information available to the participants. Merely possessing card details is not the same as being approved to provision a wallet credential, and some cards, devices or account states may be ineligible.
The token request reaches the issuer
The wallet or another approved token requestor sends a provisioning request through a token service arrangement. The token service provider coordinates with the card issuer or its processor to determine whether the underlying account is eligible and what additional checks are needed.
Participants exchange only the information permitted for their roles. The issuer remains responsible for the decision involving its account, while the wallet, network and token service may contribute device, account or prior-provisioning signals.
Identification and verification are risk-based
Low-risk requests may be approved using existing authenticated context and consistent device or account signals. Other requests can require a step-up through the issuer's application, a one-time code, a trusted contact channel, customer service or another approved method.
No single method proves every request is legitimate. Banks monitor social engineering, account takeover, recycled contact information and repeated provisioning attempts, and they provide a controlled path for legitimate customers who cannot complete the first method.
A restricted payment credential is provisioned
After approval, a payment token and related cryptographic material are delivered or activated in the permitted wallet environment. The token substitutes for the primary account number in eligible transactions and can be restricted to a particular device, wallet or use domain.
Provisioning creates the credential; it does not approve future purchases. Each transaction still follows applicable authentication, authorization, clearing and settlement processes, and the issuer can decline activity even when the wallet token itself remains active.
Lifecycle controls continue after activation
The issuer and token service maintain the relationship among the token, wallet and underlying account. A lost device, suspected compromise, account closure, card replacement or other change can lead to suspension, resumption, update or deletion of the wallet credential without treating every event the same way.
Monitoring and reconciliation cover provisioning decisions, token status changes, customer reports and transaction outcomes. Tokenization reduces exposure of reusable card data, but it does not eliminate device compromise, social engineering or fraud inside the token's permitted use.
Read the primary material
Banking Explained prioritizes regulators, official publications and first-party announcements.