Nearly 40% of Mastercard's transactions no longer carry a card number — and services, not payments, are now 41% of its revenue

Every figure in this article is drawn from Mastercard's second-quarter 2026 results and earnings call, company product announcements, or from CoinDesk, PYMNTS and Forbes as attributed. Sections marked as analysis are identified as such.

The most consequential number Mastercard disclosed this year does not appear in its income statement. Nearly 40 per cent of all Mastercard transactions are now tokenised — the card number is replaced by a credential that is useless to anyone who steals it, restricted to a particular device, merchant or, increasingly, a particular piece of software.

That single statistic explains the shape of the second-quarter results, the acquisition Mastercard agreed in March, and the reason the company is not especially frightened of the technologies that are supposed to disrupt it.

The quarter

Net revenue reached $9,277 million, up 14 per cent on an adjusted basis and about $240 million ahead of consensus. Adjusted operating income rose 16 per cent to $5,670 million on a 61.1 per cent operating margin, up 120 basis points, and adjusted earnings of $5.04 a share rose 21 per cent. Mastercard repurchased $4.9 billion of its own stock during the quarter and another $700 million by the end of July.

The volumes were solid rather than spectacular: gross dollar volume of $2,881 billion, up 8 per cent in local currency, across 47.4 billion switched transactions, up 9 per cent, on 3.73 billion cards in circulation, up 5 per cent. Cross-border assessments — the highest-yielding traffic on the network — rose 21 per cent.

Cross-border is worth pausing on, because it is where the card networks earn disproportionately and where the world's politics show up fastest. Twenty-one per cent growth in a year of tariff disputes, currency volatility and periodic travel disruption suggests that international spending — tourism, remote work, cross-border e-commerce and the growing share of ordinary online shopping that happens to be foreign — is proving far more durable than the headlines about deglobalisation imply.

Then the split that matters. Payment network revenue grew 8 per cent on a currency-neutral basis to $5,451 million. Value-added services and solutions grew 18 per cent to $3,826 million. Services are now 41 per cent of Mastercard's revenue and growing at more than twice the rate of the payments business the company is named after.

What the services business actually is

"Value-added services" is one of the least informative labels in corporate reporting, so it is worth unpacking. It covers fraud scoring and cyber intelligence, identity verification and authentication, consumer acquisition and loyalty programmes, data analytics sold back to issuers and merchants, and consulting. Growth this quarter was led by security and by digital and authentication services.

The strategically important disclosure came from chief executive Michael Miebach, who said roughly 60 per cent of value-added services revenue is network-linked — sold because a transaction crossed Mastercard's rails, and largely unsellable by anyone who does not see that transaction. It is not a diversification away from the network. It is a second, higher-priced product layered on top of the same pipe.

That distinction decides how you value the company. A payments business growing at 8 per cent with a 61 per cent margin is a fine utility. A security and identity business growing at 18 per cent, structurally attached to a network nobody can replicate, is something considerably more expensive.

It also changes who Mastercard competes with. On payments it faces Visa, domestic schemes and, at the margin, account-to-account transfers. On security and identity it faces a fragmented field of specialists, none of which can see a tenth of the world's card transactions in real time. Fraud detection is a data-scale problem, and Mastercard's data advantage compounds with every switched transaction — 47.4 billion of them in a single quarter.

Credentials for machines

Mastercard's answer to artificial intelligence is not a chatbot. It is Agent Pay, a framework under which a verified software agent receives an Agentic Token — a tokenised card credential bound to a specific agent, a specific merchant scope and a specific consent policy set by the cardholder. An agent can complete a checkout without ever seeing a card number, and the token stops working the moment it strays outside what the human authorised.

Announced in 2025 and now broadly available through certified processors, the framework has attracted more than thirty participants including Coinbase, Stripe and Adyen, with agent permissions and credentials recorded on public chains including Polygon, Solana and Base. In June the company extended it with Agent Pay for Machines, aimed at automated, always-on transactions between systems rather than people.

And in March, Mastercard agreed to buy the stablecoin infrastructure platform BVNK for up to $1.8 billion — a purchase, not a partnership, which is the sharpest difference between its posture and Visa's. Where Visa has positioned itself as "multi-coin, multi-chain" and declined to pick winners, Mastercard has bought a set of rails outright.

The logic of buying rather than partnering is straightforward once you accept that stablecoins are unlikely to replace cards and quite likely to matter for settlement between businesses. Cross-border business payments are slow, expensive and dominated by correspondent banking; a token that settles in seconds is a genuinely better product for that use, and it is a market where Mastercard has never had the card franchise to defend in the first place.

Analysis: the moat was never the card

There is a persistent misunderstanding about what card networks sell. They are not in the business of moving money — banks do that — and they are certainly not in the business of manufacturing plastic. They sell a rulebook and a guarantee: that a merchant in Lisbon can accept an instrument issued by a bank in Ohio, that the money will arrive, that fraud is somebody's defined liability, and that a disputed transaction has an adjudication process.

Every technology currently described as a threat to Mastercard removes the card and leaves that problem entirely intact. A stablecoin settles instantly and irreversibly — which is precisely the wrong property for a consumer purchase that might need reversing. An AI agent buying on your behalf raises the question of whether it was authorised, for how much, and with what recourse. These are rulebook problems, and the rulebook is the asset.

Which is why tokenisation at 40 per cent of transactions is the number to watch rather than gross dollar volume. Mastercard has spent a decade turning its credential from a printed number into a programmable object with permissions attached. Once the credential is software, extending it to a phone, a car, a subscription or an agent is a configuration change rather than a new business.

There is a competitive dimension to this as well. If agents become a meaningful channel, the company whose credential standard the agent builders adopt gets to define what an authorised machine purchase looks like — and gets paid on it. That is why Mastercard, Visa and the crypto payment companies have spent 2026 racing to publish competing agent-payment protocols. The prize is not the transaction fee. It is the rulebook, again.

Analysis: what could still go wrong

The risks are the same ones facing Visa and they are not small. The proposed merchant interchange settlement now before a US federal court would cut interchange and loosen the rules on surcharging and card acceptance, and the largest retailers have told the court they would rather go to trial than accept it. The Credit Card Competition Act, which would force a second unaffiliated network onto large issuers' credit cards, has failed repeatedly and keeps returning.

There is also the ordinary risk of a company in transition. Sachin Mehra, the chief financial officer, is moving to the newly created role of chief business officer — a handoff that arrives in the middle of a strategic repositioning. His summary of the priority is at least unambiguous: "Profitable volume, which is going to drive higher net revenue yield, is what we are going to chase." Not volume. Profitable volume.

Mastercard raised full-year revenue guidance to the low teens on a currency-neutral basis. The company is compounding at 14 per cent with a 61 per cent margin while buying stablecoin infrastructure and issuing credentials to machines — an unusually confident set of decisions for an incumbent, and a reasonable one for a business that has worked out its product was never the card in the first place.

The number that would change this assessment is the 8 per cent. Payment network revenue growing at single digits while services grow at 18 is a comfortable mix shift today; it becomes an uncomfortable one if the network line ever goes flat, because 60 per cent of the services revenue is attached to it. Mastercard's second act is built on top of its first, not beside it — and that is a strength and a dependency at the same time.