What is an Index Token used for?

• A. A cryptographic token that replaces the PAN, based on an index for an unpredictable value.
• B. A keyword used for password resets.
• C. A token that encrypts data using a fixed key.
• D. A session ID used for login persistence.

Answer: (A)

Tokenization replaces sensitive data with non-sensitive surrogates. An Index Token is a surrogate that stands in for the PAN in payment workflows. It is created so that the token points to the real PAN stored securely in a vault, using an index as the reference. The actual token is designed to be unpredictable, so you can’t reverse it to the PAN or guess the PAN from the token. This lets systems operate on the token instead of the actual card data, reducing PCI DSS scope and risk. It differs from password-reset keywords, fixed-key encryption tokens, or session IDs, which do not provide the same secure substitute for PAN.