Some experts think Apple Pay is just the tip of tokenization iceberg. It almost certainly is coming to other mobile wallets, such as Google Wallet and Softcard, formerly known as Isis, and possibly even to big online merchants such as Amazon within a matter of months, industry watchers told CU Times.

What is a token? It takes the primary account number, also known as PAN, and replaces it with a token, which is another number. In Apple Pay, a token is unique to a device, meaning it cannot be used on other devices.

The big advantage here is this method removes credit card account information from retailers. As a result, security increases, fraud losses are reduced and there is a lower incidence of card re-issuance after fraud takes place.

Right now, the token issuers are Visa, MasterCard and American Express. In the case of the first two, there are fees, said by sources to be waived for now. Visa is reportedly planning to charge seven cents per token. With MasterCard, the tariff is said to be 50 cents. Both card companies also impose monthly carrying fees on each token. That's on top of the 15 basis points per transaction issued by Apple.

One thing credit unions likely will not do is actually issue tokens. Vladimir Jovanovic, a product manager at payments CUSO PSCU in St. Petersburg, Fla., said that perhaps some of the largest credit unions might decide to take on this challenge. But for most, token issuance represents a lot of work with little gain.

Michelle Thornton, manager of core products at CO-OP Financial Services in Rancho Cucamonga, Calif., echoed Jovanovic's thought.

"I don't see our clients getting into issuing tokens," she said.

The big money center banks that were involved at Apple Pay's launch including Chase, Wells Fargo, Bank of America, Citi and Capital One, are believed to be assessing the economics of self-issuing tokens, according to some experts. However, for smaller institutions, others have indicated that, at least for now, it will probably be cheaper to use the Visa and MasterCard services.

Read more: How tokenization changes member service …

Tokenization also alters some member service processes, according to Allison Edwards, director of product delivery and support for card services at the Brookfield, Wis.-based Fiserv.

When members lose their iPhones with Apple Pay, they need to contact their financial institutions. That token has to be deactivated and when the member gets a new phone, a new token is issued. Edwards said in most cases, there isn't a need to re-issue the card, just the token.

Brandon Kuehl, senior product manager with Des Moines, Iowa-based card processor The Members Group, said tokenization brings additional maintenance chores to a credit union.

For instance, traditionally when a credit card had expired and a new one was issued, it was up to the cardholder to update any merchants that had the account number on file for recurring payments. Now, when a card expires, the credit union, not the cardholder, manually updates the record.

"You have to update Visa or MasterCard and they push that to the phone," Kuehl said. "All the updates are done by the credit union. It's no longer on the cardholder. It's on the financial institution."

Another question that frequently comes up is does tokenization erase the need for Europay, MasterCard or Visa, commonly known as EMV? Will chip and PIN or signature be the standard at retailers by October 2015, the deadline for EMV implementation.

"We see EMV and tokenization as companion technologies. EMV is for the plastic card, tokens are for digital commerce," Thornton said. "For the foreseeable future, we need EMV."

Behind that claim is the belief that, for several more decades at least, plastic cards will remain in wide use. EMV secures that data.

"Tokens will secure card not present transactions, while EMV will secure card present," Kuehl said.

It's likely that in a card not present era of tokens and biometric authentication, there will be large pressures to reduce card not present interchange rates, he added. That won't happen immediately because there needs to be substantial transaction data. However, if, as some experts expect, there is a huge reduction in fraud when tokens are involved in card not present sales, interchange will fall.

Then there is the big question of is tokenization as secure as some believe. The reality is that no one knows, Kuehl admitted.

As tokenization via Apple Pay and EMV catches hold, the big retailers such as Target and The Home Depot will no longer have vast stashes of card data to attract thieves. What they will have is one-time use tokens that may be of little interest or use to hackers.

"Tokenization is only as secure as the vault that secures them," Kuehl said.

That means MasterCard and Visa can expect to be in the crosshairs of cybercriminal gangs but they have to do better than the many breached national retailers, according to some sources. At least, that is the theory.

The other fact about tokenization is that there is a theoretical possibility an individual's token could be compromised, Kuehl said. With a plastic card, however, the technology to duplicate a card and emboss a number is plentiful. With a valid PAN, a criminal is ready to steal.

For tokenization, especially in Apple Pay, the criminal needs to be able to spoof the phone or a fingerprint, and would need to know the token. Those are a lot of obstacles and it's just not a realistic path for an average criminal to pursue, Kuehl said.

The bottom line is a tokenized transaction world could be a safer place and, although credit unions will face new fees associated with tokens, there just may be an offsetting reduction in fraud losses.