A recreation-fee system replaces stored cardholder numbers with tokens for processing, and the cashier screen shows only the last four PAN digits. Which statement best contrasts those techniques?

In a recreation-fee payment flow, tokenization replaces the primary account number in systems of record with a surrogate token that has limited or no value outside the tokenization domain. Applications, databases, and logs can process payments using the token while the real PAN stays in a tighter vault boundary, shrinking PCI scope and breach blast radius. Masking, by contrast, is primarily a presentation control: the cashier screen shows only trailing digits so shoulder-surfing and casual screen capture reveal less, without itself being the same mechanism as encryption of stored values.

Masking does not permanently destroy the original PAN in the payment processor; destruction would break legitimate refunds and settlement that still need controlled access to real card data or token mappings. Calling tokenization and masking forms of full-disk encryption confuses application-layer data protection patterns with endpoint volume encryption of the cashier workstation. Claiming masking creates reversible public-key ciphertext any kiosk can decrypt offline misstates masking entirely—masking is display obfuscation, not asymmetric encryption.

Exam caveat: tokenization substitutes stored sensitive values; masking obscures displays; neither automatically equals encryption. Operational check: verify municipal fee systems store tokens rather than PANs where possible, restrict detokenization, apply masking on UI and reports, and keep workstation FDE as a separate endpoint control rather than a substitute for PAN tokenization.