- Order is culmination of years-long probe into tokenization
- Agency says card companies use technology to stymie rivals
The
The enforcement action, approved in a 4-0 vote, is the culmination of a years-long investigation focused on Mastercard and
“This is a victory for consumers and the merchants who rely on debit-card payments to operate their businesses,”
FTC Chair
Mastercard and Visa have spent years investing in so-called tokenization technology, which swaps sensitive information such as account numbers with a unique, one-time-use set of numbers that validates a customer’s identity. The payment networks say those services were designed to reduce online card fraud and help the banks that issue credit and debit cards approve more transactions.
“While we are taking these steps to bring this matter to a close, there should be no question that tokenized transactions provide an increased level of protection to both consumers and merchants,”
But merchants have long complained about tokenization technology, especially its use in mobile payments. And the FTC said Purchase, New York-based Mastercard used its control over the tokenization process to block the use of competing card networks.
The statement didn’t say whether the FTC had reached a similar agreement with Visa. A representative for Visa didn’t immediately respond to a request for comment.
Dodd-Frank Act
More than a decade ago, Congress passed a provision in the Dodd-Frank Act called the Durbin Amendment, which ordered banks to put two competing networks on all debit cards to give merchants more choice in how they route such transactions. The move was meant to lower card acceptance costs by improving competition among networks. Banks typically issue debit cards with either Visa or Mastercard, but there are also smaller, lesser-known networks such as Pulse, Shazam and Star. These networks often charge a lower fee.
According to the FTC, Mastercard historically wouldn’t let these alternative networks access its so-called token vault. The agency said that meant that when a debit card user chooses to pay with Apple Pay or Samsung Pay, merchants would have no choice but to route the transaction over Mastercard’s network to ensure the payment would be authorized.
With Friday’s move, the agency ordered Mastercard to provide alternative debit-card networks with customers’ personal account numbers. It also banned Mastercard from “taking any action to prevent competitors from providing their own payment token service or offer tokens on Mastercard-branded debit cards.”
Eisen said the company believes its existing routing practices “are lawful and have always provided choice to merchants,” adding that Mastercard “will continue the work to update our processes to comply with the consent order and provide even greater choice.”
Visa and Mastercard have faced a barrage of criticism from regulators and lawmakers over their debit-card practices in recent years. Visa said last year that the US Department of Justice informed the company of plans to open an investigation into its US debit practices after the agency earlier blocked its proposed takeover of Plaid Inc. due to concern that Visa would use the acquisition to dominate online debit-card transactions.
The FTC’s agreement with Mastercard will be subject to public comment. After that closes, the commission will decide whether to make the order final.
(Updates with Mastercard comment in sixth and 12th paragraphs.)
To contact the reporters on this story:
To contact the editors responsible for this story:
Steve Dickson, Jon Morgan
© 2022 Bloomberg L.P. All rights reserved. Used with permission.
Learn more about Bloomberg Law or Log In to keep reading:
See Breaking News in Context
Bloomberg Law provides trusted coverage of current events enhanced with legal analysis.
Already a subscriber?
Log in to keep reading or access research tools and resources.
