What is TRID? Learn More About the Token Requestor ID

A token requestor ID (TRID) is a unique identifier that allows merchants to request network tokens from token providers and is a prerequisite for enabling network tokenization. Each merchant must obtain their unique TRID before moving forward with network tokenization through the card networks. And, because these IDs are issued independently of each other, merchants will need to register a TRID for each card network they plan to use network tokens with.

Why Use Network Tokenization with a TRID

Merchants are in a constant state of war with hackers, phishers, and other external forces looking to acquire payment information. One of the ways in which the broader payments ecosystem has started to try to protect itself is to reduce the amount of time that credit card data is ever moved around the Internet in plain text. The way to do this is to tokenize credit card information - literally replace one string (the actual card number) with another that cannot be translated back into the original. Using TRID, a merchant, when they plan to keep a customer’s details for future subscriptions (technically a Card on File (COF) transaction), requests a network token from the card network; this token is not the actual card number, but a unique identifier that can be used only in conjunction with the originally associated TRID; in other words, the transaction can only be completed for the underlying credit card when the merchant supplies both a TRID and a token that the card network recognizes as the two ‘keys’ to unlock access.

The merchant can then store the token relatively safely, as it cannot be used by any other entity: it only has value when combined with the merchant’s unique TRID, as well as all related security safeguards (usernames, passwords, and, often, whitelisted IP addresses). By not holding the cardholder data in plain text, the merchant avoids the risk of a data breach releasing customer information to hackers.

Token Requestor IDs: Details

A Token Requestor ID is primarily used, then, for provisioning merchant specific network tokens for card on file (COF), or stored, payment methods in order to increase security. 

TRIDs are 11 characters in length, with the first 3 digits representing the token service provider (TSP) for which the tokens will be used. For example, American Express TRIDs may begin with a 01 and Visa TRIDs could begin with 400. Larger TSPs frequently have more than one range.

Although a TRID will be necessary with each network from which you wish to request network tokens, it is not necessary to have TRIDs for all networks to begin requesting any network tokens. For instance, if a merchant has an assigned TRID for Visa, but is still waiting on the TRID for Mastercard, the merchant can move forward with network tokens for Visa in the meantime.

Requesting Token Requestor IDs (TRIDs)

Often, the PSP, issuing bank, or tokenization platform will handle the process of requesting TRIDs on behalf of merchants through a process called “On-Behalf-Of Token Requestor” (OBOTR).

Basis Theory, for example, can facilitate creating a merchant’s TRID as an OBOTR with each of the networks on their behalf. Once created, merchants are able to use this ID with any provider in the future. 

Depending on request volumes, there can be some delays in receiving TRIDs back from the networks - even as long as two months. It is best to request your TRID as soon as you become interested in using network tokenization to ensure you have it back in time to begin processing. 

TRID Scope Across Business Divisions

While the OBOTR will generally use the TRIDs of each of its customers to request network tokens, each merchant should have just one TRID per card network. For instance, imagine a company called Acme that operates four websites: Acme Watches, Acme Bracelets, Acme Clocks, and Acme Tiaras. While each website may have its own individual branding and infrastructure, because it is part of the same underlying entity, it will use the same TRID as the others.

Using Your Token Requestor ID

Because your TRID stays with you across PSPs and other third-party providers, you can often bring along your network-specific TRIDs into new partnerships.

For example, if you have a TRID that you created with another service provider, you can use that TRID to request tokens with Basis Theory or other TSPs.

Once issued, the TRID may not play a big part in a merchant’s day-to-day operations. It works somewhat in the background of network token issuing as a persistent “merchant ID”, of sorts. 

If you are interested in using network tokens and either already have a TRID or need to request one, Basis Theory can help. Contact us and our payments experts can walk you through the process.