Visa faces US Justice Department scrutiny for how it prices ‘Token’ technology

Visa Inc. is facing fresh scrutiny from the US Justice Department over how it charges merchants for technology it uses to protect cardholder information.

As part of a long-running DOJ investigation, enforcement officials have begun probing the payment giant’s policies for charging retailers more if they don’t use Visa’s proprietary “tokenization” technology, according to people familiar with the matter.

The service, which swaps sensitive card numbers with tokens that can only be used on a specific device or with a particular merchant, is designed to improve the security of any given payment.

The inquiries come more than two years after the agency first informed Visa it was opening an antitrust probe into the company’s practices, and several months after rival Mastercard Inc. resolved a case involving its own tokenization practices. The Justice Department has issued a raft of civil investigative demands this year regarding potential violations of the Sherman Antitrust Act, the US’s primary law aimed at reining in monopolies.

Spokespeople for Visa and the Justice Department declined to comment.

Shares of the company, which are up 16% this year, were little changed at $240.32 at 9:44 a.m. in New York.

Visa introduced tokenization in 2014. At its core, the service replaces the 16-digit account number with a token that only Visa can unlock, which protects cardholder information as it passes between retailers and banks.

Since its debut, Visa has issued more than 4 billion tokens, and more than 13,000 merchants have adopted the technology, including Netflix Inc., Microsoft Corp. and Alphabet Inc.’s Fitbit.

Visa has for years offered merchants a lower price if they use the service. The payment giant has long sought to see more of its cardholders’ information tokenized because of the vastly improved security it brings to a payment.

“In addition to enhancing security, tokenization can reduce friction in the payment process by enabling financial institutions to automatically update expired or compromised payment credentials without any manual updates made by the customer in the event that their Visa card is lost, stolen or expired,” Visa says on its website.

Pricing Tweaks

In recent weeks, as part of its normal schedule for adjusting fees, Visa and its partners informed merchants that it will tweak some of its rates in coming months, according to a document seen by Bloomberg News. The planned changes were partly what sparked the Justice Department’s renewed interest in the tokenization topic, according to the people, who asked not to be identified discussing non-public information.

Included in the plan are new rates for tokenized payments versus non-tokenized payments. Take, for instance, merchants that impose recurring charges on consumers, such as streaming services and cable-television providers. Starting in April, the largest of those will pay $1.38 in card fees for every $100 in purchases they process on a traditional Visa credit card. But the price drops to $1.28 if they use the company’s tokenization technology, the document shows.

It may be only pennies per transaction, but it adds up: Merchants last year spent a record $160.7 billion on these so-called swipe fees, up almost 17% from 2021, according to the Nilson Report. While Visa and Mastercard set the rates, it’s the banks that issue the cards that keep most of the money.

Visa’s rivals have also attracted unwanted scrutiny regarding tokenization. In December, the Federal Trade Commission — which enforces antitrust and consumer protection laws — reached a settlement with Mastercard to resolve allegations the company was using its tokenization technology to block merchants from using alternate payment networks.

The FTC is charged with enforcing the so-called Durbin Amendment, part of the 2010 Dodd-Frank law that requires banks to include two competing networks on their debit cards. The FTC alleged that Mastercard historically wouldn’t let alternative networks access its so-called token vault for certain e-commerce transactions, which meant merchants would have no choice but to route the transaction over Mastercard’s network to ensure the payment would be authorized. Under the settlement, which was finalized in May, Mastercard agreed to provide customers’ personal account numbers to those alternative networks.

Visa, though, has for years had a policy to give alternative networks access to that information, according to a person familiar with the company’s practices.

Debit Cards

The Justice Department’s Visa probe has focused on whether the San Francisco-based company has taken steps to monopolize the debit-card market in violation of antitrust law.

But Visa was in the DOJ’s crosshairs even before that investigation was announced. In 2020, the company announced plans to buy the financial-technology provider Plaid Inc., but abandoned the deal a year later after the agency sued to block the acquisition. At the time, the Justice Department called Visa’s tokenization service a “technological barrier” that it argued Visa was using to limit competitors from offering a viable product for online debit-card transactions.

Two months after it ditched the takeover, Visa disclosed that the department had informed the company of plans to open a separate investigation, and the agency soon after that issued a civil investigative demand that sought documents and information related to the company’s US debit practices and competition with other payment methods and networks.

This year, the agency issued further civil investigative demands seeking additional information about those practices. Visa has said it’s been cooperating with the investigation.