Tokenisation
Replacing sensitive values such as card numbers with surrogate tokens, keeping the real values only in a tightly controlled vault.
Tokenisation swaps a sensitive value (a PAN, a national ID) for a token with no exploitable relationship to it. A vault maps tokens to values; only a few services may detokenise. Vaultless schemes derive tokens with format-preserving encryption (NIST SP 800-38G FF1) under a key in an HSM.
Its main business value in payments is PCI DSS scope reduction: systems that only ever see tokens are largely out of scope. Format-preserving tokens (same length, valid Luhn digit, last four kept) let legacy systems store them unchanged.
Differences from hashing: tokens can be reversed by the vault and are not guessable, while a hash of a 16-digit card number can be brute forced. Risks concentrate in the vault and detokenisation API, so protect, rate-limit and audit those above everything else.