The 16-Digit Card Number Now Has an Expiration Date: 2030
The 16-digit card number now has an expiration date: 2030.
Mastercard has committed to 100% e-commerce tokenization in Europe by 2030 and is phasing out manual card entry globally. The Primary Account Number (PAN) is being replaced with network tokens, passkeys and one-click checkout. Visa has not set a formal deadline, but the direction is identical: 17.5 billion tokens already in circulation, more than three times the physical cards on its network, and a stated goal of a fully tokenized environment.
“Just like the transition from signing and swiping to tapping cards, we’re now moving from manual entry and passwords to seamless and secure payments in just a few clicks.” That is Jorn Lambert, Chief Product Officer at Mastercard.
What Replaces Manual Card Entry
- Network tokens stand in for the PAN in stored credentials and wallets. Each token is tied to a specific merchant or device and comes with a one-time cryptogram per transaction.
- Passkeys replace passwords and one-time codes for authentication, using the device’s biometrics.
- One-click checkout brings the token and the passkey together so a returning shopper confirms a purchase without typing anything.
If you want the basics of how network tokens differ from the tokens a PCI vault creates, see Network Tokenization vs PCI Tokenization.
Why This Matters More Than the Headlines Suggest
This is an authorization story, not a UX story
Tokenized transactions cut online fraud by roughly 30% compared with the PAN and lift approval rates by about 4% on average. I have seen what network tokenization plus real-time account updater can do at scale: a 6% authorization lift worth roughly $100M in annual revenue. When the token becomes the default credential, that upside becomes table stakes. Merchants who have it will simply be at parity. Merchants who do not will be behind.
Merchants still vaulting raw PANs are on a burning platform
Networks are already signaling fee pressure on legacy PAN processing. The question is no longer whether to migrate to network tokens. It is whether you migrate on your timeline or theirs.
Recurring billing is the quiet winner
Tokens survive card reissuance. When a bank replaces a card after a breach or at expiry, the token keeps working. That means fewer soft declines, less dunning and less involuntary churn, the failure modes that silently drain subscription revenue.
The PAN’s retirement is the foundation for agentic commerce
AI agents cannot be trusted with static card numbers. A reusable 16-digit credential handed to software is a fraud risk waiting to happen. Domain-restricted, cryptogram-backed tokens are the only credential architecture that scales to autonomous payments, because each token can be limited to one agent, one merchant or one spending limit.
A Practical Plan to Retire Manual Card Entry
- Measure where you are. What share of card-on-file transactions already run on network tokens? Split by network, region and payment flow.
- Turn on token provisioning with your processor or token service provider for all new stored cards.
- Migrate the existing vault. Bulk-provision tokens for stored PANs, starting with recurring and high-value customers.
- Handle the gaps. Not every issuer supports tokens equally. Keep account updater running for cards that cannot be tokenized.
- Remove manual entry where you can. Offer wallets, click-to-pay and passkey-based checkout first, with typed card entry as the fallback.
- Track the results. Approval rate, fraud rate and chargebacks for tokenized versus non-tokenized transactions.
I wrote more about the practical side in Network Tokenization Explained.
My Read
The PAN served commerce for seven decades. But a static, reusable, human-typed credential was built for a world of paper imprints, not one where a meaningful share of e-commerce is still typed by hand while fraudsters industrialize with AI.
If you run payments: what is your PAN exit plan? Are you migrating your card-on-file portfolio to network tokens proactively, or waiting for the networks to force the issue?
Sources: Mastercard Newsroom; CNBC.
Manual Card Entry: Key Takeaways
- Mastercard plans to phase out manual card entry and reach 100% e-commerce tokenization in Europe by 2030.
- Replacing manual card entry with network tokens lifts approvals and cuts fraud.
- Merchants should plan their own exit from stored card numbers before the networks set the timeline.
FAQ
Is Mastercard getting rid of card numbers?
Mastercard has committed to 100% e-commerce tokenization in Europe by 2030 and is phasing out manual card entry globally, replacing the card number (PAN) with network tokens, passkeys and one-click checkout. The card number still exists but stops being typed or stored by merchants.
How many Visa tokens are there?
Visa reports more than 17.5 billion tokens in circulation, more than three times the number of physical cards on its network.
Why do network tokens improve approval rates?
Network tokens are updated automatically when a card is reissued or expires, carry a cryptogram that proves the transaction is legitimate, and are trusted more by issuers. Industry figures cite about a 4% approval lift and around 30% less online fraud compared with raw card numbers.
A shorter version of this analysis was first published on LinkedIn on July 6, 2026.