FTC Orders an End to Illegal Mastercard Business Tactics and Requires it to Stop Blocking Competing Debit Card Payment Networks

On December 23, the Federal Trade Commission (FTC), in a 4-0 vote, ordered Mastercard to start providing competing payment networks with the customer account information they need to process debit payments, alleging that the company has violated the Durbin Amendment and federal regulations.

According to the FTC, Mastercard has allegedly been using its control over the tokenization process to keep competing networks out of the e-commerce debit payment business, in violation of provisions of the 2012 Dodd-Frank Act known as the Durbin Amendment and its implementing rule, Regulation II. Generally, the Durbin Amendment requires banks to enable at least two unaffiliated networks on every debit card and prohibits payment card networks from inhibiting merchants from using other networks.

E-commerce transactions that involve payment cards in e-wallets often replace the cardholder’s primary account number with a different number, known as a token, and store that number in the e-wallet. This “tokenization” process aims to protect the primary account number during certain stages of the transaction, as well as to reduce fraud. When a debit cardholder makes a debit purchase using an e-wallet, the merchant receives the token from the cardholder’s device and sends it to the merchant’s bank. The merchant’s bank then sends the token to a payment card network for processing, which converts it to the associated primary account number (PAN).

With respect to Mastercard-branded debit cards in e-wallets, not only does Mastercard’s policy require that a token be used, but banks that issue such cards also nearly universally use Mastercard to generate the tokens and store the corresponding PANs, according to the FTC. As a result, the FTC alleged that merchants are dependent on Mastercard to convert the token to process e-wallet transactions using Mastercard-branded debit cards, because competing payment networks do not have access to the tokens stored by Mastercard. The FTC also alleged that Mastercard refused to provide conversion services to competing payment networks for e-wallet debit transactions conducted online and in apps (rather than in person), making it impossible for merchants to route e-wallet transactions on any network other than Mastercard.

Under the FTC’s proposed order, if a competing network receives a token to process a debit card payment, Mastercard is required to provide that network with the customer’s PAN that corresponds to the token. The order also prohibits Mastercard from taking any action that prevents other payment networks from providing their own tokens or tokenization services.

The proposed order is subject to a 30-day public comment period, after which the FTC will decide whether to make it final. The FTC’s statement on its proposed order didn’t say whether it had reached a similar agreement with Visa.