The Federal Trade Commission (FTC) issued an order Friday requiring Mastercard to not block competing debit payment networks from having the customer data they need to process payments.
The FTC said in a release on Friday that Mastercard must provide customer account information to competing networks to let them process debit payments, stating that it violated provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act.
The Durbin Amendment to the Dodd-Frank Act requires banks to allow at least two unaffiliated networks on every debit card to give merchants a choice of which network to use for a debit transaction. It also prohibits payment card networks from stopping merchants from using other networks.
But the FTC alleges that Mastercard has been using illegal business tactics to require merchants to route debit card payments through its network.
“This is a victory for consumers and the merchants who rely on debit card payments to operate their businesses,” said Holly Vedova, the director of the FTC’s Bureau of Competition. “Congress directed the FTC to enforce this part of the Dodd-Frank Act and prevent precisely this kind of illegal behavior. We take this responsibility seriously, as demonstrated by our action today.”
The release states that Mastercard used its own control over a process called tokenization to stop the use of competing networks. Tokenization is a process through which a cardholder’s primary account number is replaced with a different number to protect the account number during certain stages of a debit transaction, according to the FTC.
The tokens are stored in e-wallets like Apple Pay and Google Pay and provide additional protection for a cardholder’s account number.
A merchant receives a token from a cardholder’s device when the cardholder makes a debit purchase using an e-wallet, and the token is sent to the merchant’s bank and then to a payment card network for processing.
The FTC said banks issuing Mastercard-branded debit cards “nearly universally” used Mastercard to generate tokens and store the primary account numbers in their Mastercard “token vault.” Merchants could only use Mastercard to convert the token into its account number under this system, according to the FTC.
The order will require Mastercard to provide a competing network with a customer’s personal account number when the competing network receives a token to process a debit payment.
Mastercard said in a statement that it has entered into an agreement with the FTC on the routing of tokenized debit transactions at online merchants. The company also said it believes its existing practices are lawful and have provided merchants with a choice.
The company said it will continue the work to update its processes to comply with the order and provide greater choice.
“While we are taking these steps to bring this matter to a close, there should be no question that tokenized transactions provide an increased level of protection to both consumers and merchants. This focus on security guides our efforts in a highly competitive market and provides the incentive for us to continue investing in innovations that promote the peace of mind every person expects,” the statement said.
The FTC said in its release that it voted 4-0 to issue its complaint and accept a consent agreement, and it will publish a description of the agreement soon. The agreement will be subject to public comment, and then the FTC will decide whether to make the agreement final.