Tokenisation replaces sensitive card details with a unique, meaningless value called a token. The token can be stored and used to refer to the card, but it is useless to a thief because it cannot be turned back into the card number outside the provider's secure system.
When a card is first used, the payment provider stores the real number in its secure vault and returns a token to the business. Later charges, refunds or subscriptions are made by sending the token. Mobile wallets such as Apple Pay and Google Pay use a related device-level token each time you tap.
Merchants use tokens for card-on-file accounts, repeat orders, tab pre-authorisations, loyalty-linked payments and refunds to the original card without keeping card numbers in their own database. Hospitality venues use them for open tabs and bookings.
Check that your POS and online store never log or save full card numbers, that tokens work across your channels if you want a single customer profile, and that tokens can be moved if you change provider. Tokens are normally tied to one provider, which can make switching harder.
Tokenisation reduces the amount of card data a business handles, which narrows PCI DSS scope and limits the damage from a data breach. It is a standard part of secure payment design.