Mastercard’s Tollbooth: How a Token Scheme Locked Competitors Out of Your Digital Wallet
The Non-Financial Ledger: What This Costs People Who Don’t Own Mastercard Stock
Imagine you run a small restaurant. You have a choice between two trucking companies to deliver your ingredients, but one of those companies secretly controls every loading dock in the city. You can choose whichever trucker you want, but only one of them can physically get inside to unload. That is, in plain terms, what Mastercard did to digital commerce, and the people paying for it are the owners of those restaurants and the customers eating in them.
When a customer taps their phone or clicks “pay” online, their debit card number has already been swapped out for a Mastercard-issued token, a substitute code that only Mastercard could decode. A competing payment network, say a regional network that charges merchants lower fees, could not process that transaction because they had no way to get the real account number needed to debit the customer’s bank. The door was locked. Mastercard held the only key.
The merchants absorbing those higher interchange and network fees are not abstract corporate entities. They are neighborhood pharmacies, independent grocery stores, coffee shops, and online small businesses. Every fraction of a percent in fees that Mastercard kept off the table for competitors is a fraction of a percent those merchants either absorbed as a loss or passed directly to customers at the register. Working-class households, who disproportionately rely on debit cards rather than credit cards, bore this cost on every grocery run, every prescription pickup, every bill paid online.
The law Mastercard violated, the Durbin Amendment, was itself passed in 2010 specifically because Congress recognized that without a routing choice mandate, dominant card networks would exploit exactly the leverage Mastercard just got caught exploiting. The entire point of the law was to keep fees competitive. Mastercard found the digital loophole and used it for years before federal regulators caught up.
There is no number in this consent order for how many years this went on. There is no count of how much extra merchants paid. There is no tally of how much that cost consumers. The government got Mastercard to agree to stop. It did not make anyone whole.
Legal Receipts: What the Documents Actually Say
The FTC’s consent order is public record. Below are direct, verbatim extracts from the document. No paraphrasing. No spin. The language speaks for itself.
FTC Consent Order, Docket No. C-4795 — Section II.A (The Core Injunction)
“Upon receiving a request from an Authorized Merchant, Authorized Acquirer, Authorized Competing Payment Card Network, or other Authorized Person in receipt of a Mastercard Token furnished for an Electronic Debit Transaction, Respondent shall make available a PAN for the purposes of routing to any Payment Card Network that is enabled by the Issuer on the Debit Card corresponding to that PAN. For e-commerce, card-not-present Electronic Debit Transactions, Respondent shall do so in the ordinary course, including consistent with the timeliness that Respondent provides PANs in response to requests in card-present transactions using Mastercard Tokens, and without requiring consideration for making the PAN available.”
- The phrase “without requiring consideration” is the confession buried in the legalese. “Consideration” is the legal term for payment or something of value exchanged in a contract. This language proves Mastercard was charging competing networks, merchants, or acquirers for access to account numbers those parties had a legal right to receive for free under Regulation II.
- The scope is specifically e-commerce and card-not-present transactions. This is the digital wallet and online checkout space, the fastest-growing segment of consumer payments. Mastercard’s lock was tightest precisely where transactions are growing fastest.
- The order mandates that Mastercard provide PANs at the same speed it does for card-present (in-store tap) transactions. This phrasing implies that Mastercard was previously delaying or degrading PAN delivery for online routing requests, creating a functional barrier even if not an outright refusal.
FTC Consent Order, Docket No. C-4795 — Section II.B (Token Service Provider Restriction)
“Respondent shall take no action that prohibits or inhibits any Person’s efforts to serve as a Token Service Provider or provision Payment Tokens on Mastercard-branded Debit Cards.”
- This clause confirms that Mastercard was actively blocking competing Token Service Providers from operating on Mastercard-branded cards. A Token Service Provider is the entity that creates and manages those substitute codes in a digital wallet. By monopolizing that role, Mastercard ensured that every token in every digital wallet was Mastercard’s token, and therefore required Mastercard’s cooperation to decode.
- The carve-out language (“the issuance of standards for Payment Tokens shall not by itself be construed to violate this requirement”) shows Mastercard’s lawyers negotiating room to continue writing industry technical standards, which is itself a mechanism for preserving structural advantage even under the order’s constraints.
FTC Consent Order, Docket No. C-4795 — Section II.C (The Regulation II Restatement)
“Respondent shall comply with the requirements of 12 C.F.R. § 235.7(b) and its official commentary, which, as of November 1, 2022, require that Respondent shall not, directly or through any agent, processor, or licensed member of the network, by contract, requirement, condition, penalty, or otherwise, inhibit the ability of any Person that accepts or honors debit cards for payments to direct the routing of Electronic Debit Transactions for processing over any Payment Card Network that may process such transactions.”
- The list “by contract, requirement, condition, penalty, or otherwise” is a catalogue of the specific tools Mastercard used or could use to enforce routing exclusivity. The FTC included every mechanism by name because Mastercard had deployed them. This is not preventive language; it is a prohibition shaped around documented conduct.
- The phrase “directly or through any agent, processor, or licensed member of the network” closes the indirect-action loophole. Mastercard cannot simply instruct a downstream processor or bank to enforce the restriction on its behalf and claim clean hands.
- The anchoring date “as of November 1, 2022” locks the regulatory standard at a specific version, preventing Mastercard from arguing future regulatory revisions loosen the obligation.
FTC Consent Order, Docket No. C-4795 — Section IV (Prior Notice for New Products)
“Respondent shall not, directly or indirectly, through subsidiaries or otherwise, without providing 60-days advance written notice to the Commission, commercially launch (not including any Pilot Program or other Limited Launch), any New Debit Product that requires Merchants to Route Electronic Debit Transactions only to Mastercard.”
- The carve-out for “Pilot Program or other Limited Launch” creates a documented pathway for Mastercard to test exclusionary new products on real merchants without notifying the FTC. A company that just got caught building an exclusionary technical system is explicitly permitted to quietly trial the next version of that system before regulators are informed.
- The 60-day notice window gives the FTC time to analyze a new product before launch. It does not give the FTC power to block the launch. The notice requirement is surveillance, not a veto.
“Respondent shall make available a PAN… without requiring consideration for making the PAN available.”
Societal Impact: Who Actually Paid for This
Public Health
Payment infrastructure is not an abstract finance problem. It sits underneath every economic transaction in daily life, including transactions that keep people fed, medicated, and housed.
- Pharmacies and grocery chains, many of which operate on razor-thin margins, process enormous volumes of debit card transactions daily. Every basis point of excess interchange fee Mastercard preserved by blocking competition compounds across millions of transactions into real operational costs that front-line retailers pass to consumers through pricing.
- Low-income households use debit cards at far higher rates than credit cards, precisely because debit cards do not require a credit history. These households have no means to “route around” the cost; they pay it directly through elevated prices at the stores they can afford to shop at.
- Healthcare-adjacent retail, including pharmacies and discount stores selling over-the-counter goods, operates at payment margins where the difference between a competitive network fee and a Mastercard-only fee can determine whether a product is priced accessibly. The suppression of competition in payment routing therefore has a downstream effect on access to basic goods for the most economically vulnerable consumers.
Economic Inequality
The routing monopoly Mastercard maintained did not distribute its costs equally. The extraction was concentrated at the bottom of the economic ladder and the benefits flowed upward.
- Small and independent merchants are the most harmed by network fee suppression because they lack the transaction volume to negotiate reduced rates with dominant networks. Retailers processing billions in annual volume have fee leverage; the corner store does not. Mastercard’s lock on digital wallet routing meant small businesses could never benefit from competitive network alternatives that might have offered lower rates.
- The Durbin Amendment’s routing choice provision was explicitly designed to reduce costs for merchants and, by extension, consumers. The FTC’s finding that Mastercard violated this provision confirms that the economic relief the law promised was withheld for years while Mastercard collected the difference.
- Mastercard is a publicly traded company (NYSE: MA). Its shareholders, predominantly institutional investors and high-net-worth individuals, benefited directly from the excess revenue generated by foreclosing competition. The consent order contains no clawback of those profits and no mechanism to compensate the merchants or consumers who overpaid.
- The absence of any financial penalty in this settlement means Mastercard’s cost of violating federal competition law was effectively zero. There is no deterrent signal to other dominant payment networks. The rational calculation for a company in Mastercard’s position remains: build the anticompetitive system, collect the revenue, and if regulators eventually catch up, agree to stop without admitting fault or paying a dollar.
The “Cost of a Life” Metric: What Mastercard Walked Away Paying
For comparison: the Durbin Amendment was designed to reduce merchant debit interchange fees by billions of dollars annually across the U.S. economy. Mastercard’s technical circumvention of the routing choice requirement in the digital wallet space represents a suppression of competitive fee pressure in the fastest-growing segment of payments. The dollar value of that suppression is absent from the consent order. The FTC did not calculate it. It is not required to be paid back.
What Now: The Watchlist and What to Do With It
The FTC’s consent order names the conduct, imposes a compliance structure, and sets a 10-year term. Here is every lever that exists to hold Mastercard accountable and push for stronger structural outcomes.
Corporate Leadership Subject to This Order
The consent order requires compliance reports to be verified by Mastercard’s Chief Executive Officer or a specifically authorized officer. That means the CEO is directly accountable for every compliance filing. The order also covers all directors, officers, employees, agents, subsidiaries, and affiliates of Mastercard Incorporated.
- Compliance reports must be filed with the FTC Secretary at ElectronicFilings@ftc.gov and the Compliance Division at bccompliance@ftc.gov. These are public-facing contact points.
- Any dissolution, acquisition, merger, or subsidiary restructuring by Mastercard requires 30-day advance notice to the FTC. Watch for corporate restructuring announcements that might affect the order’s enforcement reach.
Regulatory Watchlist
- Federal Trade Commission (FTC): The primary enforcer of this order. Docket No. C-4795 is the reference. Compliance reports are due every 90 days for the first year, then annually. Members of the public can monitor FTC dockets at ftc.gov.
- Consumer Financial Protection Bureau (CFPB): The CFPB oversees Regulation II (the Durbin Amendment’s implementing rule) and has independent authority to investigate debit routing compliance. Any future Mastercard conduct that appears to re-create routing exclusivity is reportable to the CFPB.
- Federal Reserve Board: The Federal Reserve promulgated Regulation II and retains supervisory authority over its implementation by payment card networks. The Fed’s supervision of network compliance is distinct from the FTC’s enforcement of the consent order.
- Department of Justice (DOJ) Antitrust Division: The DOJ has concurrent jurisdiction to bring antitrust actions against payment networks. If Mastercard’s post-order conduct develops patterns consistent with renewed exclusionary conduct, the DOJ is an additional enforcement avenue.
Direct Action and Mutual Aid
- If you own or operate a small business: You are entitled under federal law to route debit transactions over any network that is enabled on your customers’ cards. If you are encountering technical or contractual barriers from Mastercard or its affiliated processors that prevent you from exercising that routing choice, file a complaint with both the FTC (reportfraud.ftc.gov) and the CFPB (consumerfinance.gov/complaint).
- Connect with merchant trade organizations: Groups like the Merchant Payments Coalition and the Retail Industry Leaders Association actively monitor debit routing compliance and have legal resources for member businesses facing network restrictions. Organized merchant pressure is what produced the Durbin Amendment in the first place.
- Support community credit unions and local banking: Credit unions and smaller community banks are more likely to enable multiple networks on their debit cards. Routing competition only works if issuers actually enable competing networks on the cards they issue. Choosing financial institutions that prioritize network competition reduces the power of dominant card networks at the individual account level.
- Demand legislative follow-up: The absence of any financial penalty in this consent order is a policy choice, not a legal requirement. Contact your congressional representatives and ask them to support legislation that requires financial disgorgement in payment network antitrust settlements. The FTC’s existing authority allows it to seek civil penalties in some circumstances; ask your representatives why none were sought here.
- Monitor the compliance reports: Every 90-day and annual compliance report Mastercard files with the FTC is a potential public record. File Freedom of Information Act (FOIA) requests for these documents at foia.ftc.gov if they are not proactively published. Transparency pressure is compliance pressure.
The source document for this investigation is attached below.
You can read this document in the FTC’s website: https://www.ftc.gov/system/files/ftc_gov/pdf/2010011C4795MastercardDurbinOrder.pdf
Explore by category
Product Safety Violations
When companies sell dangerous goods, consumers pay the price.
View Cases →Financial Fraud & Corruption
Lies, scams, and executive impunity that distort markets.
View Cases →


