Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §2.4.1 · Jun 2022 → May 2023

PIN Entry Devices (PEDs) and Encrypting PIN Pads (EPPs)

substantive
⚠ Extraction warning — review against source PDF. One side of the Mastercard SPME text below appears to contain only the page-running header, not body content. This usually means the section heading fell on a page boundary and the body was attributed to a neighbouring section in the source PDF. The AI summary and proposed edit below may be misleading. Verify in: Jun 2022 · page 34 ↗ · May 2023 · page 34 ↗.

The updated rules clarify that devices with expired PCI PTS approvals must be tracked in inventory and that device management systems must ensure receipt of security patches and physical management, such as device listing and tampering checks.

Sources Mastercard SPME · Jun 2022 · page 34 PDF Mastercard SPME · May 2023 · page 34 PDF Fraud Monitoring current
Also in §2.x this release substantive §2.2 Mastercard Site Data Protection (SDP) Program substantive §2.2.5 SDP Program Noncompliance Assessments substantive §2.2.6 Mandatory Compliance Requirements for Compromised Entities substantive §2.3.1 Global Vendor Certification Program substantive §2.3.2 Additional Card Production Requirements
Why these edits? The expansion of device management requirements to include tracking devices with expired PCI PTS approvals and ensuring receipt of security patches impacts fraud monitoring by necessitating enhanced oversight of PIN Entry Devices to prevent tampering or unauthorized substitutions.
Mastercard SPME §2.4.1
This section was substantively restructured between versions (18% text overlap). Compare the texts directly below.
Before · Jun 2022 · page 34

Security Rules and Procedures—Merchant Edition • 22 February 2022

After · May 2023 · page 34

Security Rules and Procedures—Merchant Edition • 7 February 2023

– The device set is in inventory when the PCI PTS approval expired. Device models that reach approval expiration are moved from the PCI Approved PTS Devices list to the PIN Transaction Security Devices With Expired Approvals list. – The device set is under a device management system. Such system must ensure that devices are able to both receive software security patches when made available by the device vendor and are physically managed (for example, maintaining a list of devices and periodically inspecting devices to look for tampering or substitution).

Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7


+ authority: Mastercard SPME §3.7, §2.4.1


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


+ # Added oversight requirements for device management, including


+ # tracking of devices with expired PCI PTS approvals and ensuring


+ # receipt of security patches, to prevent tampering or substitution.


+ # This aligns with updates in Mastercard SPME §2.4.1 regarding device


+ # security and inventory controls for PIN entry devices.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

  1. Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

  1. Track case progress until the account returns to threshold compliance or is

terminated.

5. Ensure that all PIN Entry Devices used by merchants are under a device management system that tracks devices, including those with expired PCI PTS approvals, ensures timely application of security patches, and conducts periodic inspections to detect tampering or substitutions.

Source authority: Mastercard SPME §3.7.§3.7, §2.4.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

  1. Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

  1. Track case progress until the account returns to threshold compliance or is

terminated.

5. Ensure that all PIN Entry Devices used by merchants are under a device management system that tracks devices, including those with expired PCI PTS approvals, ensures timely application of security patches, and conducts periodic inspections to detect tampering or substitutions.

Source authority: Mastercard SPME §3.7.§3.7, §2.4.1.

Source authority: Mastercard SPME §2.4.1.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §2.4.1
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,8 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+# Added oversight requirements for device management, including
+# tracking of devices with expired PCI PTS approvals and ensuring
+# receipt of security patches, to prevent tampering or substitution.
+# This aligns with updates in Mastercard SPME §2.4.1 regarding device
+# security and inventory controls for PIN entry devices.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -21,5 +21,6 @@
    transaction data.
 4. Track case progress until the account returns to threshold compliance or is
    terminated.
+5. Ensure that all PIN Entry Devices used by merchants are under a device management system that tracks devices, including those with expired PCI PTS approvals, ensures timely application of security patches, and conducts periodic inspections to detect tampering or substitutions.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §2.4.1.