A payment service must replace account numbers with surrogates and recover originals only through a tightly controlled service. Which mechanism fits?

1. Compression before storage
2. An unsalted one-way hash with no mapping
3. A public checksum stored beside each account number
4. Tokenization backed by a protected mapping service