ToolingPublished ExplainedAll news from that day
Ongoing case: AI agents that buy things, and the sites that block them 2 storiesHow payment tokens let an AI agent pay without seeing your card
A payment token replaces the card's account number with a unique value that should not work beyond a set merchant, device or payment scenario, and ChatGPT Wallet uses one.
Check our sources · 9 facts from 3 sources
Illustration made with AI for ai notis
Key points
- EMVCo says tokenisation replaces the card account number with a unique alternative value, and a token should not be usable beyond a specific merchant, device or payment scenario.
- Visa says a card added to a digital wallet gets a device-specific token in place of its 16-digit number, and that tokens carry a unique cryptogram for every transaction.
- EMVCo says the impact of a payment token compromise will be much less than exposure of a card number. OpenAI says the business and agent never get actual card details.
What happened
OpenAI's ChatGPT Wallet, announced on 13 November, lets agents pay without access to a user's actual card details. The mechanism behind that is a payment token.
EMVCo describes tokenisation as replacing the card's account number with a unique alternative value, the EMV Payment Token. A token should not be usable beyond a specific merchant, device or payment scenario.
Visa says that when you add a card to a digital wallet, the 16-digit card number is replaced with a randomised set of digits. That token is specific to the device, so the same card on a phone and a tablet gets two. Visa says tokens also carry a unique cryptogram for every transaction.
In ChatGPT Wallet, OpenAI says the user approves the items, total and card with Face ID or a fingerprint, and the payment network then provides the token. The payment is charged to the user's card, and the business and the agent never get the card details.
OpenAI says some sites may still block agent purchases.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 4 of 9 · from EMVCo
EMV Payment Tokenisation enhances in-store, e-commerce and remote payment security by removing the most valuable data to a fraudster, the primary account number (PAN ), and replacing it with a unique alternative value, the EMV Payment Token.
Fact 9 of 9 · from Visa
Tokens also provide a unique cryptogram for every transaction, providing further security to each transaction.
What it means for you
Our viewA token narrows what a stolen credential can do: EMVCo says the impact of a compromise will be much less than the exposure of a card number. Whether a site accepts the agent is a separate question, and OpenAI says some sites may unintentionally block purchases through ChatGPT Wallet.
When you assess any agent that pays, find out what its token is tied to (a merchant, a device or a payment scenario) and which parties can see the card details.
It adds no new facts.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against these 3 sources.
1 Introducing ChatGPT Wallet
Open the source archived copy-
OpenAI says ChatGPT Wallet is the first wallet that lets agents pay without access to users' actual card details (post of 13 November 2026)
citeIt’s the first wallet that lets agents pay without access to users’ actual card details and that requires a security check for every purchase
-
OpenAI says the user approves each purchase with a security check such as Face ID or a fingerprint scan, then the payment network provides a payment token as a substitute for the actual card details, and the payment is charged to the selected card without sharing actual card details with the business or agent
citeBefore each purchase, the user reviews the items, total, and selected card, then approves it with a security check such as Face ID or a fingerprint scan. ... After the user approves, the payment network provides a payment token—a substitute for the user’s actual card details—with a card number, security code, and expiration date. The payment is charged to their selected card without ChatGPT Wallet sharing their actual card details with the business or agent.
-
OpenAI says some sites may unintentionally block purchases through ChatGPT Wallet or other agentic payment products
citeSome sites may unintentionally block purchases through ChatGPT Wallet or other agentic payment products, and we are focused on helping businesses make that transition.
2 EMV Payment Tokenisation
Open the source archived copy-
EMVCo says EMV Payment Tokenisation works by replacing the card account number with a unique alternative value, the EMV Payment Token
citeEMV Payment Tokenisation enhances in-store, e-commerce and remote payment security by removing the most valuable data to a fraudster, the primary account number (PAN ), and replacing it with a unique alternative value, the EMV Payment Token.
-
EMVCo says a payment token should not be usable beyond a specific merchant, device or payment scenario
citeReduces the value of stolen or compromised payments information, as an EMV Payment Token should not be usable beyond a specific merchant, device or payment scenario.
-
EMVCo says the impact from data compromise of payment tokens will be much less than exposure of a card number (PAN)
citeThis means that for cardholders and issuers, the impact from data compromise of payment tokens will be much less than if a card number (PAN) is exposed.
3 A Deep Dive into Tokenized Transactions
Open the source archived copy-
Visa says that when a card is added to a digital wallet, the 16-digit card number (PAN) is replaced with a randomized set of digits, a payment token or Device Account Number (DAN)
citeWhen you add your Visa credit card to your digital wallet and use it to pay, your 16-digit card number (PAN) is replaced with a randomized set of digits. This payment token or Device Account Number (DAN) keeps your PAN secure.
-
Visa says the DAN is device-specific, so the same card details on a phone and a tablet each get a separate DAN
citeThe DAN is, like the name suggests, device-specific. So even if you add the same card details to your phone and your tablet, each one will have a separate DAN.
-
Visa says tokens provide a unique cryptogram for every transaction
citeTokens also provide a unique cryptogram for every transaction, providing further security to each transaction.
Every sentence above is checked against these 3 sources. Each fact has its own address you can cite.
Source 1 · OpenAI · 13 Nov 2026
Introducing ChatGPT Wallet
OpenAI says ChatGPT Wallet is the first wallet that lets agents pay without access to users' actual card details (post of 13 November 2026)
It’s the first wallet that lets agents pay without access to users’ actual card details and that requires a security check for every purchase
OpenAI says the user approves each purchase with a security check such as Face ID or a fingerprint scan, then the payment network provides a payment token as a substitute for the actual card details, and the payment is charged to the selected card without sharing actual card details with the business or agent
Before each purchase, the user reviews the items, total, and selected card, then approves it with a security check such as Face ID or a fingerprint scan. ... After the user approves, the payment network provides a payment token—a substitute for the user’s actual card details—with a card number, security code, and expiration date. The payment is charged to their selected card without ChatGPT Wallet sharing their actual card details with the business or agent.
OpenAI says some sites may unintentionally block purchases through ChatGPT Wallet or other agentic payment products
Some sites may unintentionally block purchases through ChatGPT Wallet or other agentic payment products, and we are focused on helping businesses make that transition.
Source 2 · EMVCo
EMV Payment Tokenisation
EMVCo says EMV Payment Tokenisation works by replacing the card account number with a unique alternative value, the EMV Payment Token
EMV Payment Tokenisation enhances in-store, e-commerce and remote payment security by removing the most valuable data to a fraudster, the primary account number (PAN ), and replacing it with a unique alternative value, the EMV Payment Token.
EMVCo says a payment token should not be usable beyond a specific merchant, device or payment scenario
Reduces the value of stolen or compromised payments information, as an EMV Payment Token should not be usable beyond a specific merchant, device or payment scenario.
EMVCo says the impact from data compromise of payment tokens will be much less than exposure of a card number (PAN)
This means that for cardholders and issuers, the impact from data compromise of payment tokens will be much less than if a card number (PAN) is exposed.
Source 3 · Visa
A Deep Dive into Tokenized Transactions
Visa says that when a card is added to a digital wallet, the 16-digit card number (PAN) is replaced with a randomized set of digits, a payment token or Device Account Number (DAN)
When you add your Visa credit card to your digital wallet and use it to pay, your 16-digit card number (PAN) is replaced with a randomized set of digits. This payment token or Device Account Number (DAN) keeps your PAN secure.
Visa says the DAN is device-specific, so the same card details on a phone and a tablet each get a separate DAN
The DAN is, like the name suggests, device-specific. So even if you add the same card details to your phone and your tablet, each one will have a separate DAN.
Visa says tokens provide a unique cryptogram for every transaction
Tokens also provide a unique cryptogram for every transaction, providing further security to each transaction.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep