Mastercard SPME §4.10.3 · Jun 2022 → May 2023
Persistent Authentication
New detailed requirements for implementing Persistent Authentication in IoT devices were added, including Mastercard and regulatory approvals, testing and certification, use of inherence factors, a 3-second disable window, explicit cardholder consent, and a maximum 24-hour duration before re-authentication is required.
Security Rules and Procedures—Merchant Edition • 7 February 2023
when the Cardholder initiates or operates the IoT personal device, for example, when a Cardholder engages with a connected car. For Persistent Authentication, the Authenticating Entity must ensure that it has:
- Approval from Mastercard to implement Persistent Authentication for an IoT device use case; and
- Any necessary regulatory approvals needed for the Persistent Authentication and that the use of the Persistent Authentication complies with all applicable regulations. For the Authenticating Entity to perform Transactions without the use of the MFA Method to authenticate the Cardholder, Mastercard requires testing and certification of proposed functionality for Persistent Authentication with respect to the following:
- There is an inherence factor integrated within the IoT personal device, or there is a persistent check mechanism incorporated in the IoT personal device, used to detect a change in the status of the Cardholder using the device, through a combination of on-body detection mechanisms and other signals (for example, the monitoring of the Cardholder's presence in a connected car signals that it is the same car, and the doors are closed). The check/locking mechanism must be sufficiently secure to ensure that only the person who performed the initial strong customer authentication continues to be the person in possession of and operating the IoT personal device.
- The IoT device on which the MFA Method has been applied must be disabled for authentication purposes within a maximum of three seconds of the Cardholder detection.
- The Cardholder provides an explicit consent to the transaction, for example, by clicking a button on the Authenticating Entity interface, on which the transaction amount and merchant identification are both displayed or by providing voice instructions.
- The length of duration for Persistent Authentication may not exceed twentyfour hours.
- When the period ends, a new period can start after a successful authentication performed by the Authenticating Entity with the MFA Method.
program: Fraud Monitoring- authority: Mastercard SPME §3.7+ authority: Mastercard SPME §3.7, §4.10.3fraud_to_sales_ratio_threshold: 0.015min_count_per_month: 100monitoring_cadence: monthlyescalation_actions:- escalate_to_human_review- notify_acquirerlookback_period_months: 1remediation_review_interval_days: 30agent_owner: fraud_ops_agent++ # Added monitoring considerations for Persistent Authentication on IoT devices as per SPME §4.10.3+ persistent_authentication_iot:+ requires_mastercard_approval: true+ requires_regulatory_approval: true+ max_duration_hours: 24+ continuous_presence_check:+ enabled: true+ mechanism_examples:+ - on_body_detection+ - connected_car_presence+ device_disable_timeout_seconds: 3+ explicit_cardholder_consent_required: true+ reauthentication_required_after_period_end: true++ # These additions support enhanced fraud detection where authentication methods differ from traditional MFA, reflecting Mastercard guidance on IoT Persistent Authentication security requirements.
Fraud Monitoring
Halyard Pay monitors merchant fraud activity on a monthly basis to detect to identify patterns that ¶ exceed exceeding Mastercard's acceptable fraud-to-sales thresholds. A merchant whose Merchants with a rolling ¶ monthly fraud-to-sales ratio meets at or exceeds above 1.5% (0.015) and whose fraud count ¶ reaches at least 100 fraud transactions in that same month triggers mandatory escalation ¶ must be escalated for further review under this policy.
When this policy applies
This policy applies to covers all merchants processed through Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card network. It governs network, applying to both card-present and ¶ card-not-present transaction streams. types.
Required actions
-
Compute the merchant'sCalculate the merchant’s rolling fraud-to-sales ratioeach calendar month.monthly. -
If the ratio
meets or exceeds the threshold AND the minimum count is reached, ¶and volume thresholds are met, immediately escalate the merchant accounttofor humanreview immediately.compliance review. -
Notify the acquiring compliance
officer and document theofficer, documenting caseIDIDs withsupporting ¶relevant transaction data. -
TrackMonitor case progress until theaccountmerchant returns tothresholdcompliance or the account is¶terminated.
## Additional considerations regarding Persistent Authentication for IoT Devices
Given Mastercard’s updated requirements for Persistent Authentication in IoT environments (SPME §4.10.3), Halyard Pay shall integrate specific monitoring for transactions authenticated under this method. These include ensuring that persistent authentication mechanisms comply with Mastercard's testing and certification standards, maintain continuous presence detection of the cardholder, limit the authentication duration to 24 hours, and require explicit cardholder consent for each transaction.
Such requirements impact how fraud monitoring flags and assesses risk for transactions authenticated via IoT devices using persistent methods, necessitating enhanced scrutiny to prevent unauthorized transactions.
Source authority: Mastercard SPME §3.7.§§3.7, 4.10.3.
Fraud Monitoring
Halyard Pay monitors merchant fraud activity on a monthly basis to detect to identify patterns that ¶ exceed exceeding Mastercard's acceptable fraud-to-sales thresholds. A merchant whose Merchants with a rolling ¶ monthly fraud-to-sales ratio meets at or exceeds above 1.5% (0.015) and whose fraud count ¶ reaches at least 100 fraud transactions in that same month triggers mandatory escalation ¶ must be escalated for further review under this policy.
When this policy applies
This policy applies to covers all merchants processed through Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card network. It governs network, applying to both card-present and ¶ card-not-present transaction streams. types.
Required actions
-
Compute the merchant'sCalculate the merchant’s rolling fraud-to-sales ratioeach calendar month.monthly. -
If the ratio
meets or exceeds the threshold AND the minimum count is reached, ¶and volume thresholds are met, immediately escalate the merchant accounttofor humanreview immediately.compliance review. -
Notify the acquiring compliance
officer and document theofficer, documenting caseIDIDs withsupporting ¶relevant transaction data. -
TrackMonitor case progress until theaccountmerchant returns tothresholdcompliance or the account is¶terminated.
## Additional considerations regarding Persistent Authentication for IoT Devices
Given Mastercard’s updated requirements for Persistent Authentication in IoT environments (SPME §4.10.3), Halyard Pay shall integrate specific monitoring for transactions authenticated under this method. These include ensuring that persistent authentication mechanisms comply with Mastercard's testing and certification standards, maintain continuous presence detection of the cardholder, limit the authentication duration to 24 hours, and require explicit cardholder consent for each transaction.
Such requirements impact how fraud monitoring flags and assesses risk for transactions authenticated via IoT devices using persistent methods, necessitating enhanced scrutiny to prevent unauthorized transactions.
Source authority: Mastercard SPME §3.7.§§3.7, 4.10.3.
Source authority: Mastercard SPME §4.10.3.
--- a/policies/fraud_monitoring/rules.yaml +++ b/policies/fraud_monitoring/rules.yaml @@ -1,5 +1,5 @@ program: Fraud Monitoring -authority: Mastercard SPME §3.7 +authority: Mastercard SPME §3.7, §4.10.3 fraud_to_sales_ratio_threshold: 0.015 min_count_per_month: 100 monitoring_cadence: monthly @@ -9,3 +9,19 @@ lookback_period_months: 1 remediation_review_interval_days: 30 agent_owner: fraud_ops_agent + +# Added monitoring considerations for Persistent Authentication on IoT devices as per SPME §4.10.3 +persistent_authentication_iot: + requires_mastercard_approval: true + requires_regulatory_approval: true + max_duration_hours: 24 + continuous_presence_check: + enabled: true + mechanism_examples: + - on_body_detection + - connected_car_presence + device_disable_timeout_seconds: 3 + explicit_cardholder_consent_required: true + reauthentication_required_after_period_end: true + +# These additions support enhanced fraud detection where authentication methods differ from traditional MFA, reflecting Mastercard guidance on IoT Persistent Authentication security requirements. --- a/policies/fraud_monitoring/policy.md +++ b/policies/fraud_monitoring/policy.md @@ -1,25 +1,22 @@ # Fraud Monitoring -Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that -exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling -monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count -reaches at least 100 transactions in that same month triggers mandatory escalation -under this policy. +Halyard Pay monitors merchant fraud activity monthly to identify patterns exceeding Mastercard's fraud-to-sales thresholds. Merchants with a rolling monthly fraud-to-sales ratio at or above 1.5% (0.015) and at least 100 fraud transactions must be escalated for further review under this policy. ## When this policy applies -This policy applies to all merchants processed through Halyard Pay's acquiring platform -where Mastercard is the applicable card network. It governs both card-present and -card-not-present transaction streams. +This policy covers all merchants processed through Halyard Pay's acquiring platform where Mastercard is the card network, applying to both card-present and card-not-present transaction types. ## Required actions -1. Compute the merchant's rolling fraud-to-sales ratio each calendar month. -2. If the ratio meets or exceeds the threshold AND the minimum count is reached, - escalate the merchant account to human review immediately. -3. Notify the acquiring compliance officer and document the case ID with supporting - transaction data. -4. Track case progress until the account returns to threshold compliance or is - terminated. +1. Calculate the merchant’s rolling fraud-to-sales ratio monthly. +2. If the ratio and volume thresholds are met, immediately escalate the merchant account for human compliance review. +3. Notify the acquiring compliance officer, documenting case IDs with relevant transaction data. +4. Monitor case progress until the merchant returns to compliance or the account is terminated. -Source authority: Mastercard SPME §3.7. +## Additional considerations regarding Persistent Authentication for IoT Devices + +Given Mastercard’s updated requirements for Persistent Authentication in IoT environments (SPME §4.10.3), Halyard Pay shall integrate specific monitoring for transactions authenticated under this method. These include ensuring that persistent authentication mechanisms comply with Mastercard's testing and certification standards, maintain continuous presence detection of the cardholder, limit the authentication duration to 24 hours, and require explicit cardholder consent for each transaction. + +Such requirements impact how fraud monitoring flags and assesses risk for transactions authenticated via IoT devices using persistent methods, necessitating enhanced scrutiny to prevent unauthorized transactions. + +Source authority: Mastercard SPME §§3.7, 4.10.3.