Key escrow is achieved without a key escrow facility. An escrow key pair is generated and stored in the terminal. A key escrow field that includes a traffic key encrypted with the escrow key is provided before encrypted traffic is communicated. When access to the traffic key is authorized, the escrow key is extracted from the terminal and used to decrypt the traffic key. The private portion of the escrow key is covered in the terminal with an escrow key access number. The escrow key access number is preferably generated by the terminal manufacturer with a secret algorithm using the terminal serial number. Alternatively, the escrow key is stored within a user token, rather than the terminal.