Mastercard SPME §3.12.4 · Jun 2022 → May 2023

Acquirer Requirements for CVC 2

substantive

The new version adds a requirement that Acquirers must monitor their Merchants and take action if a Merchant exceeds 100 gross basis points in fraudulent Card-not-present transactions for two consecutive months, a new threshold-based fraud control obligation not present in the prior version.

Sources Mastercard SPME · Jun 2022 · page 42 PDF Mastercard SPME · May 2023 · page 42 PDF Fraud Monitoring current

Also in §3.x this release substantive §3.11.7 Use of a Vendor substantive §3.13.4 Additional Service Code Information

Why these edits? The new requirement obligates Acquirers to monitor their Merchants for instances where fraudulent Card-not-present transaction rates exceed 100 gross basis points for two consecutive months, thereby expanding the scope of fraud monitoring obligations in policy.

Mastercard SPME §3.12.4

When the Merchant provides the CVC 2 value, the Acquirer must include the CVC 2 value in DE 48, subelement 92 of the Authorization Request/0100 message or Financial Transaction Request/0200 message. The Acquirer is also responsible for ensuring that the Merchant receives the CVC 2 response code provided by the Issuer in DE 48, subelement 87 of the Authorization Request Response/0110 message or Financial Transaction Request Response/0210 message. ~~All non-face-to-face gambling~~ An Acquirer must ensure that each of its Merchants that has exceeded 100 gross basis points in fraudulent Card-not-present (CNP) Transactions ~~conducted with a Mastercard Card~~ for two must include the CVC 2 value in DE 48 (Additional Data—Private Use), subelement ¶ 92 (CVC 2) of the Authorization Request/0100 message, unless either of the ¶ following is present: ¶ • ¶ A valid Accountholder Authentication Value (AAV) in DE 48, subelement 43 ¶ (Universal Cardholder Authentication Field [UCAF]) resulting from an EMV 3DS ¶ authentication; or ¶ • ¶ In the case of a recurring payment Transaction, Identity Check Insights ¶ (previously known as Data Only).consecutive calendar months:

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME 3.7, 3.12.4
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
- lookback_period_months: 1
+ lookback_period_months: 2
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ 
+ # Added a requirement aligned with Mastercard SPME 3.12.4 that Acquirers must monitor Merchants exceeding 100 gross basis points in fraudulent CNP transactions for two consecutive months and escalate accordingly.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that ¶ exceed Mastercard's acceptable fraud-to-sales thresholds. A Specifically, a merchant whose rolling ¶ monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count ¶ reaches at least 100 transactions in that same month ~~triggers~~ requires mandatory escalation ~~¶ under this policy.~~ as outlined below.

Additionally, per the latest Mastercard SPME §3.12.4 updates, Halyard Pay tracks merchants processing Card-not-present (CNP) transactions exceeding 100 gross basis points in fraudulent activity for two consecutive calendar months. Such merchants trigger enhanced monitoring and compliance measures.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card ~~network. It governs~~ network and includes both card-present and ¶ card-not-present transaction streams. Enhanced monitoring applies when fraud thresholds in CNP transactions are exceeded consecutively as noted above.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold ~~AND~~ and the minimum count is reached, ¶ escalate the merchant account to for human review immediately.
For merchants exceeding 1.0% fraud rate in Card-not-present transactions for two consecutive months, initiate enhanced monitoring protocols as per updated Mastercard requirements.

4. Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.

4. 5. Track case progress until the account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME ~~§3.7.~~§§3.7, 3.12.4.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

When this policy applies

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold ~~AND~~ and the minimum count is reached, ¶ escalate the merchant account to for human review immediately.
For merchants exceeding 1.0% fraud rate in Card-not-present transactions for two consecutive months, initiate enhanced monitoring protocols as per updated Mastercard requirements.

4. Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.

4. 5. Track case progress until the account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME ~~§3.7.~~§§3.7, 3.12.4.

Source authority: Mastercard SPME §3.12.4.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,11 +1,13 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME 3.7, 3.12.4
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
 escalation_actions:
   - escalate_to_human_review
   - notify_acquirer
-lookback_period_months: 1
+lookback_period_months: 2
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+
+# Added a requirement aligned with Mastercard SPME 3.12.4 that Acquirers must monitor Merchants exceeding 100 gross basis points in fraudulent CNP transactions for two consecutive months and escalate accordingly.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -1,25 +1,19 @@
 # Fraud Monitoring
 
-Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that
-exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling
-monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count
-reaches at least 100 transactions in that same month triggers mandatory escalation
-under this policy.
+Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that exceed Mastercard's acceptable fraud-to-sales thresholds. Specifically, a merchant whose rolling monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count reaches at least 100 transactions in that same month requires mandatory escalation as outlined below.
+
+Additionally, per the latest Mastercard SPME §3.12.4 updates, Halyard Pay tracks merchants processing Card-not-present (CNP) transactions exceeding 100 gross basis points in fraudulent activity for two consecutive calendar months. Such merchants trigger enhanced monitoring and compliance measures.
 
 ## When this policy applies
 
-This policy applies to all merchants processed through Halyard Pay's acquiring platform
-where Mastercard is the applicable card network. It governs both card-present and
-card-not-present transaction streams.
+This policy applies to all merchants processed through Halyard Pay's acquiring platform where Mastercard is the applicable card network and includes both card-present and card-not-present transaction streams. Enhanced monitoring applies when fraud thresholds in CNP transactions are exceeded consecutively as noted above.
 
 ## Required actions
 
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
-2. If the ratio meets or exceeds the threshold AND the minimum count is reached,
-   escalate the merchant account to human review immediately.
-3. Notify the acquiring compliance officer and document the case ID with supporting
-   transaction data.
-4. Track case progress until the account returns to threshold compliance or is
-   terminated.
+2. If the ratio meets or exceeds the threshold and the minimum count is reached, escalate the merchant account for human review immediately.
+3. For merchants exceeding 1.0% fraud rate in Card-not-present transactions for two consecutive months, initiate enhanced monitoring protocols as per updated Mastercard requirements.
+4. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+5. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §§3.7, 3.12.4.