The U.S. Federal Trade Commission on Friday ordered Mastercard Inc. to change how it processes transactions that consumers make using debit cards.

In particular, the order focuses on debit cards connected to digital wallet apps such as Apple Pay and Google Pay. The FTC determined that Mastercard’s business practices in the digital wallet market violate the 2010 Dodd-Frank Act. The agency has ordered the company to change those business practices.

“This is a victory for consumers and the merchants who rely on debit card payments to operate their businesses,” said Holly Vedova, the director of the FTC’s Bureau of Competition. “Congress directed the FTC to enforce this part of the Dodd-Frank Act and prevent precisely this kind of illegal behavior. We take this responsibility seriously, as demonstrated by our action today.”

When a shopper makes a debit card purchase, the shopper’s bank must approve the transaction before it can be completed. Approving a transaction requires banks to access certain financial information. That information includes, among other data points, the account number of the shopper who made the purchase.

Mastercard operates a system that supplies banks with the financial information they need to approve debit card purchases. Visa Inc. and American Express Co. provide competing platforms. Such platforms are known in the financial sector as payment card networks.

The order that the FTC issued on Friday focuses on Mastercard’s use of a cybersecurity method known as tokenization. The method involves substituting a sensitive piece of data, such as a debit card holder’s account number, with a second piece of data. That second piece of data is then used for payment processing purposes, while the original account number is kept in a secure environment to reduce the risk of hacking.

According to the FTC, the way Mastercard uses tokenization violates a section of the Dodd-Frank Act known as the Durbin Amendment. The amendment specifies that a debit card must be capable of processing transactions using multiple payment card networks. A Mastercard-branded card, for example, must support not only the Mastercard network but also two or more competing platforms, such as Visa and American Express. 

The FTC determined that Mastercard fell short of regulatory requirements. According to the agency, the company’s tokenization mechanism blocks debit cards linked to digital wallet apps from interoperating with rival payment card networks such as Visa and American Express. The order issued on Friday required Mastercard to change that practice.

The FTC’s commissioners approved the enforcement action 4-0. Members of the public will have 30 days to submit comments once a detailed description of the agency’s order is published in the Federal Registry. After reviewing the comments, the FTC will determine whether to make the order final.

Image: Mastercard