[shampine]

Generally tokenization is done by some vault or processor. I don't know how Amazon operates internally, due to their scale means it's probably all in house. But Visa does have token representations and they do also have visa account updater (which keeps visa/merchants in sync for saved instruments .. e.g. Netflix). I've never seen the token implemented, generally just some vault (Braintree, Spreedly, etc). And if you are typing in a 15/16 digit number it's likely being vaulted/tokenized but not by the issuer but by the merchant/processor.