In 2024 Visa reported issuing 13.7 billion network tokens cumulatively since launching its tokenisation service in 2014, with roughly 50 per cent of its global e-commerce transactions tokenised, according to June 2025 industry coverage. Mastercard reported that 30 per cent of its transactions were tokenised in 2024, in a January 2025 statement. Those two numbers describe the back-end of the modern US digital wallet. Apple Pay, Google Wallet, and Samsung Wallet are the visible brands, but the work that makes them safer than swiping a plastic card happens on the network tokenisation rails operated by Visa and Mastercard.
The Layered Stack Behind a Tap
A US digital wallet is a layered system. The user-facing app sits on top: Apple Pay, Google Wallet, Samsung Wallet, plus bank-issued wallets like Chase Pay and the consumer apps from Block and PayPal. Underneath the app is the device-level secure storage, either a hardware secure element (iPhone, certain Samsung handsets) or a software-emulated equivalent using host card emulation on most Android devices. The third layer is the tokenisation service, run by the card networks and increasingly by issuer-side platforms, which replaces the customer’s actual card number with a network token specific to the device or merchant. The fourth layer is the issuer’s authorisation system, which sees the token rather than the underlying account number and decides whether to approve.
The combination matters because it determines what the wallet can actually do safely. A wallet with hardware secure-element storage can authenticate the user with on-device biometric and present a cryptographic device-bound proof on every tap. A software-emulated wallet has to depend more heavily on network-side risk signals. The token system in the middle is what lets a stolen wallet not also mean a stolen card. Most retail conversations about wallets focus on the brand experience. The infrastructure conversation focuses on the token economics, which determine the per-transaction trust the rest of the system can place in any given wallet.
Who Runs the Back-End
Three groups of firms provide the unglamorous infrastructure. The first is the card network tokenisation services: Visa Token Service, Mastercard Digital Enablement Service, and the American Express token platform. They issue, lifecycle, and devalue tokens. The second is the issuer-side wallet enablement vendors, including Giesecke+Devrient, Thales, and IDEMIA, along with the in-house teams at the largest US issuers. They handle the provisioning step where a card is securely loaded into a wallet, including device attestation, customer authentication, and ongoing token management. The third is the wallet platform operators themselves, with Apple, Google, and Samsung running the consumer-facing stack while integrating with bank and network back-ends.
Tokenisation as the Fraud-Economics Lever
Tokenisation has fundamentally changed the fraud economics of US wallet transactions. A network token tied to a specific device or merchant has very little resale value if stolen, and stolen tokens cannot be replayed on other merchants. The fraud baseline against which to measure the gains is the Nilson Report’s total global card-fraud figure for 2024, which dipped about 1.2 per cent to $33.41 billion, per a January 2026 Nilson press release. Despite the headline decline, the US accounted for roughly 41.87 per cent of those losses, well above its share of global card volume. Tokenisation works in the US specifically because the US is the most fraud-affected card market, and removing the customer’s primary card number from merchant systems removes the most valuable target for attackers.
Authorisation economics are shifting too. With tokens carrying richer cryptographic signal, networks and issuers can run more sophisticated authentication decisions per transaction. EMV 3DS, the second generation of the 3D Secure standard, lets a token-and-device-bound authentication satisfy the strong customer authentication signal without forcing a one-time-code prompt. US issuers report lower false-decline rates on tokenised wallet flows, although exact figures vary by issuer and product portfolio. False-decline reduction is one of the quieter benefits of tokenisation, since it shows up as approved spend rather than as prevented loss.
The Push-Provisioning UX
Push provisioning is the recent UX battleground. Instead of a customer adding a card manually, push provisioning lets the issuer push a card into the customer’s wallet directly from its mobile app. Apple, Google, and Samsung each support push provisioning, and the largest US issuers have made it the default flow for new card activations. The flow improves activation rates dramatically by removing the friction of typing a sixteen-digit card number and waiting for an SMS one-time code. For neobanks and embedded-card programmes, push provisioning is the most important UX feature of the past three years. The conversion uplift translates directly into per-account economics that compound across the customer lifetime.
Beyond payment cards, the same wallets are expanding into government credentials. ISO 18013-5 mobile driver’s licence (mDL) deployments are live in several US states by 2026, with Apple, Google, and Samsung supporting it natively. The Transportation Security Administration accepts mDL at selected US airports. Health insurance cards, loyalty cards, transit passes, and event tickets are increasingly delivered through wallets rather than separate apps. The infrastructure required for non-payment credentials is different from EMV tokenisation, but the underlying secure element and the wallet platforms reuse most of the same surface. The marginal cost of adding a new credential type to a wallet has fallen sharply once the credential format settles on a standard.
| Network | 2024 / 2025 tokenisation metric | Primary source |
|---|---|---|
| Visa | 13.7 billion cumulative network tokens issued; ~50 per cent of global e-commerce transactions tokenised | Payments Dive |
| Mastercard | 30 per cent of all transactions tokenised in 2024 | Crypto.news, citing Mastercard 10-K |
Sources linked in the right column.
Where the Architecture Goes Next
Three threads will shape US wallet infrastructure through 2027. First, the GENIUS Act stablecoin framework signed into law in July 2025 has set the regulatory perimeter for US-issued stablecoins. Wallet platforms have not yet integrated stablecoins as a first-class payment option in the way they integrated cards, but the underlying capability is straightforward: a stablecoin in a wallet is conceptually the same as a tokenised card balance. The 2026 question is which wallet integrates first and on what terms. Second, the maturation of mDL beyond pilots into routine identity verification will reshape the wallet from a payments product into an identity product. Third, the Apple/Google contactless-NFC access conversation, which moved through US Department of Justice and Federal Trade Commission scrutiny in 2024 and 2025, will determine whether non-platform wallets can use the same secure-element capabilities Apple Pay and Google Wallet currently dominate.
The interesting question for US wallet infrastructure in 2026 is not which wallet brand wins consumer mindshare. It is which back-end tokenisation platforms, provisioning vendors, and credential standards capture the next generation of payment-and-identity flows. The brands sit on top of that decision, not below it, and the firms doing the most consequential work are the ones whose names do not appear on the consumer’s phone screen. The brand layer is downstream of the architecture layer in this market.
The story of US digital wallets in 2026 is the story of an unglamorous infrastructure layer carrying more value every year. The retail tap is the visible part. The cryptographic plumbing underneath is the part that determines what the next decade looks like.
