How to Restore Payments Competition

History has shown the two global card networks will never introduce real competition on their own. Time for regulators to intervene. The Fed and the FTC have made a start.

The recent clarification by the Federal Reserve confirming that a more than 10-year-old law applies to online debit cards—coupled with ongoing global card network oversight by the Federal Trade Commission (FTC)—will help improve payment security by restoring competition for online payments.

The Fed’s ruling has clarified existing law. It makes the point that it no longer accepts banks’ phony excuses for ignoring the Durbin Amendment’s debit-routing enablement requirements for online purchases. Although most merchant advocates would submit the amendment’s language clearly calls for routing choice regardless of whether a debit transaction originates at a store location, via a mobile device, or online, the fact is most of the largest issuers have ignored the law for over a decade.

More recently, the FTC’s decision to investigate whether tokenization inhibits debit routing suggests the agency will not tolerate efforts by the two global networks to stifle competition by hiding behind their proprietary technology.

Mastercard currently does not permit domestic debit networks to route tokenized transactions through their vaults. And, to my knowledge, neither Visa nor Mastercard has been willing to pass token-security credentials along to issuers for any domestic debit network transactions.

Global network officials and their advocates have publicly dismissed these actions by the Fed and the FTC as essentially meaningless, suggesting nothing will likely change as a result. They have touted the superiority of their two-message platforms over the single-message platforms employed by domestic debit networks. Two-message platforms perform payment authorization and payment settlement separately, while single-
message platforms perform both steps in a single message to the card issuer.

The global networks have also portrayed their dominant share of online debit as resulting from fair and open competition.

Some of us beg to differ.

Ill Prepared

Many senior payments veterans will recall how the regional debit networks, which were created in the 1980s and ‘90s, revolutionized payment processing by requiring online authorization of cash withdrawals at ATMs. Later on, these same debit networks leveraged the same process to authorize and settle payment purchases.

The Iowa Transfer System pioneered the use of real-time, single-
message processing for use in authorizing and posting purchases originating at the merchant’s point-of-sale. Prior to the advent of debit networks, banks were not comfortable with the risk associated with the rule-based payment-authorization platforms operated by the credit card networks.

As a result, early attempts by the credit card networks to develop debit products failed miserably for lack of acceptance by merchants and consumers.

The regional debit networks introduced single-message payment processing. With this method, the debit networks, bank processors, and the banks themselves were able to not only validate the identity of every cardholder using an ATM, but also were able to verify that adequate funds were available in the cardholder’s account to “approve” all money withdrawn from ATMs instantly.

Single-message transaction data was automatically posted to the cardholder’s account, eliminating the need for a cumbersome, batch-processed second message to be sent at a later time. It is instructive to note that the leading global network itself relied on single-message processing when it created Visa DPS (Debit Processing Services Inc.) in the mid-1990s.

Debit at the merchant point-of-sale was largely non-existent until the debit networks began to offer the capability to banks and merchants in the ‘90s. Mobil Oil was the first national chain to accept ATM/debit cards at its locations throughout the U.S. Mobil’s lead was soon followed by local and regional competitors, as well as by pioneers from non-petroleum markets. All of them installed PIN pads to accept debit cards processed by single-message networks.

One might argue that dual-message credit card networks would have eventually developed ubiquitous acceptance of dual-message debit cards at the merchant point-of-sale. But it’s hard to imagine this would have happened as fast as it did without the original efforts by the single-message debit networks, given the banks’ concerns about the security of purchases relying primarily on signatures at the point-of-sale as well as the delayed posting of purchases relying on the batch processing implicit in two-message systems.

Indeed, the Fed’s own surveys illustrate the vast superiority of single-message PIN-based debit over two-message signature debit in mitigating fraud at the POS.

Unfortunately for the regional debit networks, they were owned by many of the same big banks that owned the global credit networks. As big banks consolidated over the years, they insisted their networks consolidate as well. They had no interest in maintaining ownership or participation in multiple regional debit and international credit networks.

Credit networks eventually figured out how to offer successful debit cards, despite the fact they relied on outdated, fraud-prone dual-message platforms. Sadly, these same systems continue to limp along today, as resistant to change as their network owners and bank clients. Both owners are loath to invest in the real-time processing needed for tomorrow’s commerce and are ill-prepared for the fraud that will arise from quantum computing.

Restraining Trade

Aside from regulators’ stated goals of enhancing competition by requiring routing choice, there remains their concern about global networks using their proprietary technology—tokenization—to stifle competition.

While most would agree that tokenization itself is a good thing insofar as it mitigates fraud, many would argue that it is not a substitute for two-factor authentication. As payment fraud continues to increase in the United States and other countries, it enhances the likelihood that two-factor authentication will re-emerge, given the excellent track record of PINs in stopping fraud.

The International Standards Organization (ISO) developed the card-numbering paradigm that became the standard in the early 1960s, when digital computing was in its infancy. The standard was meant to uniquely identify both the network and the bank associated with cards issued by individual banks.

It worked well for decades as a simplistic solution—for the challenge that arose in the ‘60s. Today, it begs for replacement or updating, since the dominant networks use it to impede competition. How? In practice, tokenization limits competition, since the global networks insist that all cards bearing their card numbers must rely on the networks as a token-service provider for the banks that issue their cards.

While the global networks contend that, under certain circumstances, they will approve of a token-service provider (TSP) other than themselves, I am unaware of a competing debit network ever winning approval to act as a TSP. This restrains free and competitive trade.

Perhaps regulators could address this restriction and enhance competition by forcing card numbers to be portable, as has been the case for many years with telephone numbers. They could also clarify that card prefixes and numbers are the sole property of the financial institutions that issue the cards, not of the card networks.

Time Is Short

Unfortunately, the U.S. payment system does not exemplify the state of the art in payments today. It will never do so while the big banks and their global networks are in charge. These entities are quite content with their extraordinary profits, marketplace dominance, and historical freedom from real governmental scrutiny.

Competition from debit networks paved the way for today’s ubiquitous merchant acceptance of debit cards at the point of sale. It also provided a less fraud-prone alternative to two-message, signature networks. Competition from the Fed’s own real-time payment solution, FedNow, should help restore real payments competition after its launch next summer.

But empowering debit networks to compete with the credit card network duopoly by removing the barriers to competition will help as well.

Time is running out on the battle to keep fraudsters at bay. Given the likelihood that sophisticated quantum-computing systems will eventually be used by crooks to attack the rusty rails characterized by the two-message payment platforms, we don’t have the luxury of relying on the big banks and their networks. They won’t innovate. They’ll just count their profits.

—Mark Horwedel