Mastercard SPME §4.10.1 · Jun 2022 → May 2023

Security Evaluation of Multi-Factor Authentication Methods

substantive

Added a new requirement stating that in the EEA, San Marino, UK, and Gibraltar, Multi-Factor Authentication methods must comply with audit requirements from PSD2 RTS on Strong Customer Authentication and UK Technical Standards on SCA, with assurance levels affecting issuer reliance on fraud prevention.

Sources Mastercard SPME · Jun 2022 PDF Mastercard SPME · May 2023 · page 53 PDF Fraud Monitoring current

Also in §4.x this release substantive §4.10 Multi-Factor Authentication Methods for Remote Commerce substantive §4.10.3 Persistent Authentication substantive §4.10.4 Prolonged Authentication substantive §4.10.6 Use of a Vendor

Why these edits? The new requirement mandates MFA methods in certain regions to comply with PSD2 RTS and UK Technical Standards audits, impacting risk and fraud detection measures that fall under Fraud Monitoring.

Mastercard SPME §4.10.1

This section was substantively restructured between versions (0% text overlap). Compare the texts directly below.

Before · Jun 2022

After · May 2023 · page 53

Security Rules and Procedures—Merchant Edition • 7 February 2023

In the EEA, San Marino, United Kingdom, and Gibraltar, MFA Methods are subject to the audit requirements set out in Article 3 of the PSD2 RTS on SCA and UK Technical Standards on SCA. The level of assurance may be a relevant factor in Issuer reliance on the solution for fraud deterrence.

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME §3.7, §4.10.1
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ # Added citation to SPME §4.10.1 regarding MFA method audit requirements in specific regions, which affect fraud detection and monitoring parameters.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that ¶ exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling ¶ monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count ¶ reaches at least 100 transactions in that same month triggers mandatory escalation ¶ under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card network. It governs both card-present and ¶ card-not-present transaction streams. Additionally, in the EEA, San Marino, United Kingdom, and Gibraltar, fraud monitoring incorporates audit requirements for Multi-Factor Authentication (MFA) methods per PSD2 RTS on SCA and UK Technical Standards on SCA, reflecting enhanced fraud deterrence measures.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached, ¶ escalate the merchant account to human review immediately.
Ensure that MFA methods used comply with applicable PSD2 and UK Technical Standards audit requirements in designated regions.

4. Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.

4. 5. Track case progress until the account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §4.10.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

When this policy applies

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached, ¶ escalate the merchant account to human review immediately.
Ensure that MFA methods used comply with applicable PSD2 and UK Technical Standards audit requirements in designated regions.

4. Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.

4. 5. Track case progress until the account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §4.10.1.

Source authority: Mastercard SPME §4.10.1.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §4.10.1
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,4 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+# Added citation to SPME §4.10.1 regarding MFA method audit requirements in specific regions, which affect fraud detection and monitoring parameters.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -1,25 +1,17 @@
 # Fraud Monitoring
 
-Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that
-exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling
-monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count
-reaches at least 100 transactions in that same month triggers mandatory escalation
-under this policy.
+Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count reaches at least 100 transactions in that same month triggers mandatory escalation under this policy.
 
 ## When this policy applies
 
-This policy applies to all merchants processed through Halyard Pay's acquiring platform
-where Mastercard is the applicable card network. It governs both card-present and
-card-not-present transaction streams.
+This policy applies to all merchants processed through Halyard Pay's acquiring platform where Mastercard is the applicable card network. It governs both card-present and card-not-present transaction streams. Additionally, in the EEA, San Marino, United Kingdom, and Gibraltar, fraud monitoring incorporates audit requirements for Multi-Factor Authentication (MFA) methods per PSD2 RTS on SCA and UK Technical Standards on SCA, reflecting enhanced fraud deterrence measures.
 
 ## Required actions
 
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
-2. If the ratio meets or exceeds the threshold AND the minimum count is reached,
-   escalate the merchant account to human review immediately.
-3. Notify the acquiring compliance officer and document the case ID with supporting
-   transaction data.
-4. Track case progress until the account returns to threshold compliance or is
-   terminated.
+2. If the ratio meets or exceeds the threshold AND the minimum count is reached, escalate the merchant account to human review immediately.
+3. Ensure that MFA methods used comply with applicable PSD2 and UK Technical Standards audit requirements in designated regions.
+4. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+5. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §4.10.1.