Visa scrutinized over info security

‘Tokenization’ tech charges for merchants getting look from U.S.

A man enters the Visa office in Foster City, Calif., in this file photo. (Bloomberg News WPNS/David Paul Morris)

Visa is facing fresh scrutiny from the U.S. Justice Department over how it charges merchants for technology it uses to protect cardholder information.

As part of a long–running inquiry, enforcement officials have begun investigating the payment giant's policies for charging retailers more if they don't use Visa's proprietary "tokenization" technology, according to people familiar with the matter.

The service, which swaps sensitive card numbers with tokens that can only be used on a specific device or with a particular merchant, is designed to improve the security of any given payment.

The inquiries come more than two years after the agency first informed Visa it was opening an antitrust investigation into the company's practices, and several months after rival Mastercard resolved a case involving its own tokenization practices. The Justice Department has issued a raft of civil investigative demands this year regarding potential violations of the Sherman Antitrust Act, the U.S.'s primary law aimed at reining in monopolies.

Spokespeople for Visa and the Justice Department declined to comment.

Visa introduced tokenization in 2014. At its core, the service replaces the 16–digit account number with a token that only Visa can unlock, which protects cardholder information as it passes between retailers and banks.

Since its debut, Visa has issued more than 4 billion tokens, and more than 13,000 merchants have adopted the technology, including Netflix, Microsoft and Alphabet's Fitbit.

Visa has for years offered merchants a lower price if they use the service. The payment giant has long sought to see more of its cardholders' information tokenized because of the vastly improved security it brings to a payment.

"In addition to enhancing security, tokenization can reduce friction in the payment process by enabling financial institutions to automatically update expired or compromised payment credentials without any manual updates made by the customer in the event that their Visa card is lost, stolen or expired," Visa says on its website.

In recent weeks, as part of its normal schedule for adjusting fees, Visa and its partners informed merchants that it will tweak some of its rates in coming months, according to a document seen by Bloomberg News. The planned changes were partly what sparked the Justice Department's renewed interest in the tokenization topic, according to the people, who asked not to be identified discussing nonpublic information.

Included in the plan are new rates for tokenized payments versus non–tokenized payments. Take, for instance, merchants that impose recurring charges on consumers, such as streaming services and cable–television providers. Starting in April, the largest of those will pay $1.38 in card fees for every $100 in purchases they process on a traditional Visa card. But the price drops to $1.28 if they use the company's tokenization technology, the document shows.

It may be only pennies per transaction, but it adds up: Merchants last year spent a record $160.7 billion on these so–called swipe fees, up almost 17% from 2021, according to the Nilson Report. While Visa and Mastercard set the rates, it's the banks that issue the cards that keep most of the money.