to replicate the payment card, you would need to sign the transaction with the card itself. Currently, one can do MITM attack copying the token and then spend all your coins. btw. How did you envision the vault? Does it run inside the TEE or how would you assure security of the token? You could also pick a confidential blockchain like Oasis Sapphire and do the decryption there on-chain with a read-only query.