The Federal Trade Commission is ordering an end to illegal business tactics used by Mastercard to force merchants to route debit card payments through its payment network and requiring Mastercard to stop blocking the use of competing debit card payment networks.
Under the FTC’s proposed ruling, Mastercard would have to begin providing competing networks with the customer account information they need to process debit payments, reversing a practice the company allegedly used to keep them out of the e-commerce debit business and, according to the FTC -u , which violated provisions of the 2010 Dodd-Frank Act known as the Durbin Amendment and its implementing rule, Regulation II.
“This is a win for consumers and merchants who rely on debit card payments to conduct their business,” said Holly Vedova, director of the FTC’s Office of Competition. “Congress directed the FTC to enforce this part of the Dodd-Frank Act and prevent exactly this type of illegal behavior. We take this responsibility seriously, as demonstrated by our action today.”
Debit card payment networks
With more than 80 percent of American adults carrying at least one debit card and more than $4 trillion in debit card purchases each year, debit cards occupy a significant place in the current payment landscape. Debit cards are growing in popularity especially rapidly for purchases made by consumers using their personal devices equipped with e-wallet applications such as Apple Pay, Google Pay and Samsung Wallet.
Payment card networks play a key role in these debit card transactions. When a customer presents their debit card to make a purchase, the network sends the payment information to the card’s corresponding bank for approval, then returns the approval or decline to the merchant. Payment card networks compete for the business of banks that issue cards and for the business of merchants that accept card payments.
Mastercard is, along with Visa, one of the two leading payment card networks in the United States. Processing fees charged by the networks total billions of dollars each year, affecting every purchase made with a debit card, according to the FTC. Most of these fees are paid by merchants to card issuing banks and payment card networks.
To encourage more competition among payment card networks, Congress passed a provision of the 2010 Dodd-Frank Act known as the Durbin Amendment, which requires banks to enable at least two unrelated networks on each debit card, giving merchants a choice of which network to use for a specific debit transaction. The Durbin Amendment—along with its implementing rule, Regulation II—also prohibits payment card networks from barring merchants from using other networks.
Mastercard’s Illegal Tactics
With the rise of debit e-commerce and e-wallet debit transactions post-Durbin, Mastercard defied the law by setting rules to block merchants from diverting e-commerce transactions using Mastercard debit cards stored in e-wallets to alternative payment card networks, including networks that can charge lower fees than Mastercard, the FTC claims.
Specifically, Mastercard used its control over a process called “tokenization” to block the use of competing payment card networks, the agency claimed. Transactions are typically “tokenized” by replacing the cardholder’s primary account number with a different number to protect the account number during some stages of the debit transaction.
Tokens are stored in e-wallets such as Apple Pay, Google Pay and Samsung Wallet and serve as a surrogate credential to provide additional protection for the cardholder’s account number.
When a debit cardholder makes a debit purchase using an e-wallet, the merchant receives a token from the cardholder’s device and sends it to the merchant’s bank, which in turn sends the token to the payment card network for processing. However, for the transaction to proceed, the network must be able to convert the token into the corresponding account number.
Mastercard policy requires the use of tokens when a cardholder loads a Mastercard debit card into an eWallet, while banks that issue Mastercard debit cards almost universally use Mastercard to generate tokens and store the corresponding primary account numbers in their Mastercard “token vault”. ,” states the FTC. Because competing networks do not have access to Mastercard’s token vault, merchants depend on Mastercard’s token conversion to process eWallet transactions using Mastercard-branded debit cards.
According to the FTC, Mastercard refuses to provide conversion services to competing networks for remote e-wallet debit transactions (i.eonline and in-app transactions, as opposed to in-person in-store transactions), making it impossible for merchants to route their eWallet transactions to a non-Mastercard network.
According to the FTC’s consent order, when a competing network receives a debit card payment processing token, Mastercard must give them the customer’s personal account number that matches the token. The order also prohibits Mastercard from taking any action to prevent competitors from providing their own payment token service or offering tokens on Mastercard-branded debit cards and requires Mastercard to comply with the provisions of Regulation II.
The commission voted to issue an administrative complaint and acceptance of the consent agreement was 4-0. The FTC will soon publish a description of the consent agreement package in the Federal Register. The agreement will be subject to public comment, after which the Commission will decide whether the proposed consent order will be final. Instructions for submitting comments can be found in the published notice. Comments must be received 30 days after publication in the Federal Register. After processing, comments will be posted on Regulations.gov.
NOTE: The Commission files an administrative complaint when it has “reason to believe” that the law has been violated or is being violated, and it appears to the Commission that the proceeding is in the public interest. When the Commission issues a final consent order, it has the force of law with respect to future actions. Any violation of such order may result in a civil penalty of up to $46,517.