The Federal Trade Commission ordered Mastercard Inc. to start providing its competitors with customer account information they need to process debit payments, a move that could cut costs for merchants.

The enforcement action, approved in a 4-0 vote, is the culmination of a years-long investigation focused on Mastercard and Visa Inc.’s policies prohibiting merchants from routing card transactions over alternative debit networks. At issue is whether the payment giants were violating part of the Dodd-Frank Act, which required banks to enable at least two unaffiliated networks on every debit card.

“This is a victory for consumers and the merchants who rely on debit-card payments to operate their businesses,” Holly Vedova, director of the FTC’s Bureau of Competition, said in a statement Friday.

FTC Chair Lina Khan has pledged to use the agency’s full authority to crack down on corporate abuses of power. The announcement on Friday is the latest in a series of actions against large corporations, including Microsoft Inc., which the commission is suing over its $69 billion acquisition of Activision Blizzard Inc.

Mastercard and Visa have spent years investing in so-called tokenization technology, which swaps sensitive information such as account numbers with a unique, one-time-use set of numbers that validates a customer’s identity. The payment networks say those services were designed to reduce online card fraud and help the banks that issue credit and debit cards approve more transactions.

“While we are taking these steps to bring this matter to a close, there should be no question that tokenized transactions provide an increased level of protection to both consumers and merchants,” Seth Eisen, a spokesman for Mastercard, said in an emailed statement. “This focus on security guides our efforts in a highly competitive market and provides the incentive for us to continue investing in innovations that promote the peace of mind every person expects.”

But merchants have long complained about tokenization technology, especially its use in mobile payments. And the FTC said Purchase, New York-based Mastercard used its control over the tokenization process to block the use of competing card networks.

The statement didn’t say whether the FTC had reached a similar agreement with Visa. A representative for Visa didn’t immediately respond to a request for comment.

Dodd-Frank Act

More than a decade ago, Congress passed a provision in the Dodd-Frank Act called the Durbin Amendment, which ordered banks to put two competing networks on all debit cards to give merchants more choice in how they route such transactions. The move was meant to lower card acceptance costs by improving competition among networks. Banks typically issue debit cards with either Visa or Mastercard, but there are also smaller, lesser-known networks such as Pulse, Shazam and Star. These networks often charge a lower fee.

According to the FTC, Mastercard historically wouldn’t let these alternative networks access its so-called token vault. The agency said that meant that when a debit card user chooses to pay with Apple Pay or Samsung Pay, merchants would have no choice but to route the transaction over Mastercard’s network to ensure the payment would be authorized.

With Friday’s move, the agency ordered Mastercard to provide alternative debit-card networks with customers’ personal account numbers. It also banned Mastercard from “taking any action to prevent competitors from providing their own payment token service or offer tokens on Mastercard-branded debit cards.”

Eisen said the company believes its existing routing practices “are lawful and have always provided choice to merchants,” adding that Mastercard “will continue the work to update our processes to comply with the consent order and provide even greater choice.”

Visa and Mastercard have faced a barrage of criticism from regulators and lawmakers over their debit-card practices in recent years. Visa said last year that the US Department of Justice informed the company of plans to open an investigation into its US debit practices after the agency earlier blocked its proposed takeover of Plaid Inc. due to concern that Visa would use the acquisition to dominate online debit-card transactions.

The FTC’s agreement with Mastercard will be subject to public comment. After that closes, the commission will decide whether to make the order final.

–By Emily Birnbaum and Jenny Surane (Bloomberg)