Token management and handling system

1. A method, comprising:

maintaining, in a memory, by one or more computer processors, a mapping of tokens to account numbers, wherein at least some account numbers are assigned multiple tokens;

receiving, by the one or more computer processors, a transaction token obtained from a transaction card during a particular transaction, the transaction card comprising a card body having a first number in human-readable form thereon, the first number identifying an account, and a magnetic stripe on the card body, the magnetic stripe having a second number stored thereon, the second number being different than the first and the second number identifying the same account as the first number; wherein the transaction token is one of the first number and the second number and corresponds to a real primary account number associated with the transaction card, but does not itself reveal the real primary account number;

maintaining, by the one or more computer processors, in the memory a set of domain restrictions that specify particular payment domains in which particular tokens are permitted to be used;

for the particular transaction, receiving, by the one or more computer processors, an indication of a payment domain in which the transaction token is being used to attempt the particular transaction, wherein the indication of the payment domain in which the transaction token is being used indicates how the transaction token was obtained from the transaction card;

comparing, by the one or more computer processors, the indicated payment domain, in which the transaction token is being used to attempt the particular transaction, with the payment domain restrictions to determine whether use of the transaction token in the indicated payment domain is permitted by the domain restrictions; and

causing the particular transaction to fail upon a determination that use of the transaction token in the indicated payment domain, in which the transaction token is being used to attempt the particular transaction, is not permitted by the domain restrictions.

2. A system, comprising:

a processor; and

a memory, the memory holding data and holding instructions that, when executed by the processor, cause the system to:

maintain in the memory a mapping of tokens to account numbers;

maintain in the memory a set of domain restrictions that specify particular payment domains in which particular tokens are permitted to be used;

receive a transaction token and an indication of a payment domain in which the transaction token is being used to attempt a particular transaction, wherein the transaction token corresponds to a real primary account number, the token does not itself reveal the real primary account number, and the indication of a payment domain in which the transaction token is being used to attempt the transaction indicates how the transaction token was obtained from a payment device;

compare the domain in which the transaction token is being used with the domain restrictions to determine whether the domain in which the transaction token is being used is permitted by the domain restrictions; and

cause the particular transaction to fail upon a determination that the domain in which the transaction token is being used is not permitted by the domain restrictions.

3. The method of claim 1 , wherein the indication of the payment domain in which the transaction token is being used indicates that the transaction token was read from the magnetic stripe on the transaction card; or wherein the transaction card further comprises a chip having a third number stored therein, and the indication of the payment domain in which the transaction token is being used indicates that the transaction token was read from the chip of the transaction card; or wherein the indication of the payment domain in which the transaction token is being used indicates that the transaction token was entered in a card-not-present transaction.

4. The system of claim 2 , wherein the indication of a payment domain in which the transaction token is being used to attempt the transaction indicates that the transaction token was read from a magnetic stripe on a transaction card; or wherein the indication of a payment domain in which the transaction token is being used to attempt the transaction indicates that the transaction token was read from a chip of a payment device; or wherein the indication of a payment domain in which the transaction token is being used to attempt the transaction indicates that the token was entered during a card-not-present transaction.

5. A method, comprising:

maintaining, in a memory, by one or more computer processors, a mapping of a plurality of tokens to a primary account number;

maintaining, in the memory, by the one or more computer processors, a respective set of one or more domain restrictions associated with each of the plurality of tokens, wherein each domain restriction identifies a payment domain in which the associated token may be used;

receiving, by the one or more computer processors, a transaction token obtained from a transaction card during a particular transaction, wherein the transaction token is one of a first number on the transaction card in human-readable form, a second number encoded in a magnetic stripe of the transaction card, or a third number encoded in a chip embedded in the transaction card, and wherein the transaction token corresponds to the primary account number associated with the transaction card, but does not itself reveal the primary account number;

retrieving, by the one or more computer processors, the primary account number by looking up the primary account number in the mapping based on the transaction token;

for the particular transaction, receiving, by the one or more computer processors, an indication of a payment domain in which the transaction token is being used to attempt the transaction, wherein the indication of the payment domain in which the transaction token is being used indicates how the transaction token was obtained from the transaction card;

retrieving, by the one or more computer processors, the domain restrictions associated with the transaction token;

comparing, by the one or more computer processors, the indicated payment domain, in which the transaction token is being used to attempt the transaction, with the retrieved domain restrictions to determine whether use of the transaction token in the indicated payment domain is permitted by the domain restrictions; and

processing the particular transaction upon a determination that use of the transaction token in the indicated payment domain, in which the transaction token is being used to attempt the transaction, is permitted by the domain restrictions.

6. The method of claim 5 , wherein the particular transaction is a first particular transaction, the transaction card is a first transaction card, the transaction token is a first transaction token, the primary account number is a first primary account number, the payment domain is a first payment domain, the indication of the payment domain is a first indication of the first payment domain, and the domain restrictions are first domain restrictions, the method further comprising:

receiving, by the one or more computer processors, a second transaction token originating from a second transaction card during a second particular transaction, wherein the second transaction token is one of a fourth number on the second transaction card in human-readable form, a fifth number encoded in a magnetic stripe of the second transaction card, or a sixth number encoded in a chip embedded in the second transaction card, and wherein the second transaction token corresponds to a second primary account number associated with the second transaction card, but does not itself reveal the second primary account number;

for the second particular transaction, receiving, by the one or more computer processors, a second indication of a second payment domain in which the second transaction token is being used to attempt the second particular transaction, wherein the second indication of the payment domain in which the second transaction token is being used indicates how the second transaction token was obtained from the second transaction card;

retrieving, by the one or more computer processors, second domain restrictions associated with the second transaction token;

comparing, by the one or more computer processors, the second indicated payment domain with the retrieved second domain restrictions to determine whether use of the second transaction token in the second indicated payment domain is permitted by the second domain restrictions; and

causing the second particular transaction to fail upon a determination that use of the second transaction token in the indicated second payment domain is not permitted by the second domain restrictions.

7. The method of claim 5 , wherein the indication of the payment domain in which the token is being used indicates that the transaction token was read from the magnetic stripe on the transaction card.

8. The method of claim 5 , wherein the indication of the payment domain in which the token is being used indicates that the transaction token was read from the chip embedded in the transaction card.

9. The method of claim 5 , wherein the indication of the payment domain in which the token is being used indicates that the transaction token was entered in a card-not-present transaction.

10. A system, comprising:

one or more processors; and

a memory, the memory holding data and holding instructions that, when executed by the one or more processors, cause the system to:

maintain, in the memory, a mapping of a plurality of tokens to a primary account number;

maintain, in the memory, a respective set of one or more domain restrictions associated with each of the plurality of tokens, wherein each domain restriction identifies a payment domain in which the associated token may be used;

receive a transaction token obtained from a transaction card during a particular transaction, wherein the transaction token is one of a first number on the transaction card in human-readable form, a second number encoded in a magnetic stripe of the transaction card, or a third number encoded in a chip embedded in the transaction card, and wherein the transaction token corresponds to a real primary account number, but does not itself reveal the primary account number;

receive for the particular transaction an indication of a payment domain in which the transaction token is being used to attempt the transaction, wherein the indication of the payment domain in which the transaction token is being used indicates how the transaction token was obtained from the transaction card;

retrieve the domain restrictions associated with the one of the plurality of tokens corresponding to the transaction token;

compare the domain indication with the domain restrictions to determine whether use of the transaction token in the indicated payment domain, in which the token is being used, is permitted by the domain restrictions; and

process the particular transaction upon a determination that the domain in which the token is being used is permitted by the domain restrictions.

11. The system of claim 10 , wherein particular transaction is a first particular transaction, the transaction card is a first transaction card, the transaction token is a first transaction token, the primary account number is a first primary account number, the payment domain is a first payment domain, the indication of the payment domain is a first indication of the first payment domain, and the domain restrictions are first domain restrictions, and the instructions further cause the system to:

receive a second transaction token originating from a second transaction card during a second particular transaction, wherein the second transaction token is one of a fourth number on the second transaction card in human-readable form, a fifth number encoded in a magnetic stripe of the second transaction card, or a sixth number encoded in a chip embedded in the second transaction card, and wherein the second transaction token corresponds to a second primary account number associated with the second transaction card, but does not itself reveal the second primary account number;

for the second particular transaction, receive a second indication of a second payment domain in which the second transaction token is being used to attempt the second particular transaction, wherein the second indication of the payment domain in which the second transaction token is being used indicates how the second transaction token was obtained from the second transaction card;

retrieve second domain restrictions associated with the second transaction token;

compare the second indicated payment domain with the retrieved second domain restrictions to determine whether use of the second transaction token in the second indicated payment domain is permitted by the second domain restrictions; and

cause the second particular transaction to fail upon a determination that use of the second transaction token in the indicated second payment domain is not permitted by the second domain restrictions.

12. The system of claim 10 , wherein the indication of the payment domain in which the token is being used to attempt the transaction indicates that the token was read from the magnetic stripe on the transaction card.

13. The system of claim 10 , wherein the indication of the payment domain in which the token is being used to attempt the transaction indicates that the token was read from the chip of the transaction card.

14. The system of claim 10 , wherein the indication of the payment domain in which the token is being used to attempt the transaction indicates that the token was entered during a card-not-present transaction.