The only security issue I have with tokenization is that the tokens remain "open" after use. When you make a purchase, the store receives a one time token, However, that token remains in their system so they can process returns, refunds, etc to your CC. When you go to a restaurant or bar and run an open tab and they require CC ahead of time, the token remains valid until final payment is authorized. So although tokenization is much more secure, hackers could find a way to access the tokens and possibly access your CC. The problem with tokenization, there is no guarantee how secure that store's system really is, because there is no universal security measures. That is left up to each merchant, and thus the merchant again becomes the weakest link.