Payment Tokenization Shield (2D)

Payment Protections

Attacker Tap Point

Transaction Rate 2.0 tx/s

Live Readouts

Transactions Tapped

Skim Success Rate

Data Seen at Tap

RAW PAN

PCI-DSS Exposure Score

100 / 100 — Critical

Capture Log

How it works

capture = true                         if tap = Card Reader
capture = raw(PAN)                     if tap = Controller
capture = raw(PAN) AND NOT TLS         if tap = Network
Exposure = 20 (physical, fixed)
         + 40 × [tokenization = OFF]
         + 40 × [TLS = OFF]

Each simulated card swipe travels Reader → Controller → Network link → Processor. A hardware skimmer clipped onto the card reader captures the raw PAN unconditionally — no software control can stop it, which is why physical tamper-resistance matters regardless of toggles. Tapping the controller's memory only yields something useful if tokenization is off (PCI DSS forbids storing/forwarding the raw PAN once a token exists). Tapping the network wire only yields something useful if the payload is still raw and TLS is off — with TLS on, or with tokenization already applied, the wire carries nothing a fraudster can reuse.

Tokenization — replaces the card number with a single-use token right after the reader; a captured token is worthless to a fraudster.
TLS Encryption — encrypts whatever payload reaches the network link; blocks interception on the wire even if tokenization is off.
Attacker Tap Point — moves the eavesdropper along the pipeline; the Reader tap always succeeds because it predates every digital control.
PCI-DSS Exposure Score — a posture-level score independent of where the attacker happens to be tapping right now: a fixed 20-point baseline for irreducible physical-skim risk, plus up to 80 points for whichever software controls are disabled.

Real-world relevance: PCI DSS explicitly forbids storing raw PAN after authorization and mandates encrypted transmission — this is why modern POS and vending payment terminals tokenize at the point of read and tunnel everything over TLS 1.2+, so that even a fully compromised network segment yields nothing usable.

Raw PAN packet Tokenized packet TLS-encrypted on wire Skimmed successfully

drag: pan · wheel: zoom