Mastercard SPME §3.11.7 · Jun 2022 → May 2023
Use of a Vendor
The new version expands rules on Card-not-present Transactions, detailing when CVC 2 data collection is not required, including valid AAV from EMV 3DS, recurring payments with Identity Check Insights, credential-on-file, commercial Card Virtual Accounts, and Click-To-Pay transactions. Issuers must decline POS transactions if CVC 2 mismatches for mail, phone, or e-commerce orders.
Security Rules and Procedures—Merchant Edition • 22 February 2022
Service codes apply to magnetic stripe-read Transactions only. In the case of Chip Cards used in Hybrid POS Terminals, the Hybrid POS Terminal uses the data encoded in the chip to complete the Transaction. NOTE: A value of 2 or 6 in position 1 of the service code indicates that a chip is present on a Card, which contains the Mastercard application that is present on the magnetic stripe.
Security Rules and Procedures—Merchant Edition • 7 February 2023
- A valid Accountholder Authentication Value (AAV) in DE 48, subelement 43 (Universal Cardholder Authentication Field [UCAF]) resulting from an EMV 3DS authentication; or
- In the case of a recurring payment Transaction, Identity Check Insights (previously known as Data Only). With the exception of non-face-to-face gambling Transactions, the collection and/or transmission of CVC 2 data is not required when submitting the following types of Card-not-present Transaction authorization requests:
- A valid Accountholder Authentication Value (AAV) resulting from an EMV 3DS authentication or a Digital Secure Remote Payment (DSRP) is present in the authorization request message
- Credential-on-file Transactions (including Account Status Inquiry (ASI) and tokenization requests of a credential-on-file) flagged correctly in the authorization request message
- Identity Check Insights Transactions (previously known as Data Only)
- Transactions involving a Mastercard commercial Card Virtual Account
- Click-To-Pay or Secure Remote Commerce Transactions An Issuer must decline a Mastercard POS Transaction identified as a mail order, phone order, or e-commerce Transaction when the CVC 2 transmitted by the Acquirer does not match the CVC 2 on file with the Issuer corresponding to the Mastercard Account in question (as indicated by a value of N in DE 48, subelement 87 of the Authorization Request Response/0110 message).
program: Fraud Monitoring- authority: Mastercard SPME §3.7+ authority: Mastercard SPME §3.7, §3.11.7fraud_to_sales_ratio_threshold: 0.015min_count_per_month: 100monitoring_cadence: monthlyescalation_actions:- escalate_to_human_review- notify_acquirerlookback_period_months: 1remediation_review_interval_days: 30agent_owner: fraud_ops_agent++ # Added details to reflect updated Mastercard rules about CVC2 collection and issuer decline requirements for Card-not-present transactions as per SPME §3.11.7, impacting fraud detection rules for such transactions.
Fraud Monitoring
Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that
exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling
monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count
reaches at least 100 transactions in that same month triggers mandatory escalation
under this policy.
When this policy applies
This policy applies to all merchants processed through Halyard Pay's acquiring platform
where Mastercard is the applicable card network. It governs both card-present and
card-not-present transaction streams. streams, including those involving CVC2 collection exceptions as outlined by Mastercard.
Required actions
-
Compute the merchant's rolling fraud-to-sales ratio each calendar month.
-
If the ratio meets or exceeds the threshold AND the minimum count is reached,
escalate the merchant account to human review immediately.
- Verify CVC2 data presence and validity for card-not-present transactions per Mastercard's current mandates, noting exceptions such as EMV 3DS authentications, credential-on-file transactions, Identity Check Insights, Mastercard commercial virtual accounts, and Secure Remote Commerce.
4. Notify the acquiring compliance officer and document the case ID with supporting
transaction data.
4. 5. Track case progress until the account returns to threshold compliance or is
terminated.
Source authority: Mastercard SPME §3.7.§3.7, §3.11.7.
Fraud Monitoring
Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that
exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling
monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count
reaches at least 100 transactions in that same month triggers mandatory escalation
under this policy.
When this policy applies
This policy applies to all merchants processed through Halyard Pay's acquiring platform
where Mastercard is the applicable card network. It governs both card-present and
card-not-present transaction streams. streams, including those involving CVC2 collection exceptions as outlined by Mastercard.
Required actions
-
Compute the merchant's rolling fraud-to-sales ratio each calendar month.
-
If the ratio meets or exceeds the threshold AND the minimum count is reached,
escalate the merchant account to human review immediately.
- Verify CVC2 data presence and validity for card-not-present transactions per Mastercard's current mandates, noting exceptions such as EMV 3DS authentications, credential-on-file transactions, Identity Check Insights, Mastercard commercial virtual accounts, and Secure Remote Commerce.
4. Notify the acquiring compliance officer and document the case ID with supporting
transaction data.
4. 5. Track case progress until the account returns to threshold compliance or is
terminated.
Source authority: Mastercard SPME §3.7.§3.7, §3.11.7.
Source authority: Mastercard SPME §3.11.7.
--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §3.11.7
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
@@ -9,3 +9,5 @@
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+
+# Added details to reflect updated Mastercard rules about CVC2 collection and issuer decline requirements for Card-not-present transactions as per SPME §3.11.7, impacting fraud detection rules for such transactions.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -10,16 +10,17 @@
This policy applies to all merchants processed through Halyard Pay's acquiring platform
where Mastercard is the applicable card network. It governs both card-present and
-card-not-present transaction streams.
+card-not-present transaction streams, including those involving CVC2 collection exceptions as outlined by Mastercard.
## Required actions
1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
2. If the ratio meets or exceeds the threshold AND the minimum count is reached,
escalate the merchant account to human review immediately.
-3. Notify the acquiring compliance officer and document the case ID with supporting
+3. Verify CVC2 data presence and validity for card-not-present transactions per Mastercard's current mandates, noting exceptions such as EMV 3DS authentications, credential-on-file transactions, Identity Check Insights, Mastercard commercial virtual accounts, and Secure Remote Commerce.
+4. Notify the acquiring compliance officer and document the case ID with supporting
transaction data.
-4. Track case progress until the account returns to threshold compliance or is
+5. Track case progress until the account returns to threshold compliance or is
terminated.
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §3.11.7.