Mastercard SPME §4.10.4 · Jun 2022 → May 2023

Prolonged Authentication

substantive

This added section defines conditions for Prolonged Authentication, requiring initial MFA, explicit cardholder consent, one authentication factor for each transaction, and a maximum authentication open period of five continuous minutes to allow transactions without repeated MFA.

Sources Mastercard SPME · Jun 2022 PDF Mastercard SPME · May 2023 · page 56 PDF Fraud Monitoring current

Also in §4.x this release substantive §4.10 Multi-Factor Authentication Methods for Remote Commerce substantive §4.10.1 Security Evaluation of Multi-Factor Authentication Methods substantive §4.10.3 Persistent Authentication substantive §4.10.6 Use of a Vendor

Why these edits? The new Prolonged Authentication section requires initial MFA, explicit cardholder consent, and limits the authentication window to five minutes, directly impacting fraud monitoring protocols to ensure compliance with these authentication controls.

Mastercard SPME §4.10.4

This section was substantively restructured between versions (0% text overlap). Compare the texts directly below.

Before · Jun 2022

After · May 2023 · page 56

Security Rules and Procedures—Merchant Edition • 7 February 2023

A successful Prolonged Authentication will be dependent upon an initial authentication performed by the Authenticating Entity with the MFA Method; for example, an authentication performed before a Cardholder can access a Stored Credential. For the Authenticating Entity to perform a transaction without the use of the MFA Method, Mastercard requires testing of the proposed functionality for Prolonged Authentication with respect to the following:

The Cardholder provides an explicit consent before a Transaction may be effected, for example, by clicking a button on the Authenticating Entity interface.
The Authenticating Entity authenticates the Cardholder with one Authentication factor, which may be an existing factor of the MFA Method (in the EEA and United Kingdom, this is in order to comply with the dynamic linking requirement); and
The open period ends, which may not exceed five continuous minutes

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME §3.7, §4.10.4
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ prolonged_authentication_controls:
+   initial_mfa_required: true
+   explicit_cardholder_consent_required: true
+   max_authentication_window_minutes: 5
+ 
+ # The Fraud Monitoring program now incorporates additional controls in accordance with Mastercard SPME §4.10.4,
+ # mandating initial MFA, explicit cardholder consent before transaction, and a brief authentication window.
+ # This ensures the monitoring and escalation process aligns with updated authentication security requirements.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that ¶ exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling ¶ monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count ¶ reaches at least 100 transactions in that same month triggers mandatory escalation ¶ under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card network. It governs both card-present and ¶ card-not-present transaction streams.

This policy specifically incorporates rules related to authentication processes, including the recently updated Mastercard requirements for Prolonged Authentication, which mandates initial multi-factor authentication, explicit cardholder consent, and limits the authentication window to five minutes.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached, ¶ escalate the merchant account to human review immediately.
Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.
Track case progress until the account returns to threshold compliance or is ¶ terminated.

5. Ensure ongoing monitoring includes verification that merchant authentication processes comply with Mastercard's Prolonged Authentication requirements to mitigate fraud risks effectively.

Source authority: Mastercard SPME ~~§3.7.~~§3.7 and §4.10.4.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

When this policy applies

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached, ¶ escalate the merchant account to human review immediately.
Notify the acquiring compliance officer and document the case ID with supporting ¶ transaction data.
Track case progress until the account returns to threshold compliance or is ¶ terminated.

5. Ensure ongoing monitoring includes verification that merchant authentication processes comply with Mastercard's Prolonged Authentication requirements to mitigate fraud risks effectively.

Source authority: Mastercard SPME ~~§3.7.~~§3.7 and §4.10.4.

Source authority: Mastercard SPME §4.10.4.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §4.10.4
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,11 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+prolonged_authentication_controls:
+  initial_mfa_required: true
+  explicit_cardholder_consent_required: true
+  max_authentication_window_minutes: 5
+
+# The Fraud Monitoring program now incorporates additional controls in accordance with Mastercard SPME §4.10.4,
+# mandating initial MFA, explicit cardholder consent before transaction, and a brief authentication window.
+# This ensures the monitoring and escalation process aligns with updated authentication security requirements.

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -1,25 +1,19 @@
 # Fraud Monitoring
 
-Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that
-exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling
-monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count
-reaches at least 100 transactions in that same month triggers mandatory escalation
-under this policy.
+Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count reaches at least 100 transactions in that same month triggers mandatory escalation under this policy.
 
 ## When this policy applies
 
-This policy applies to all merchants processed through Halyard Pay's acquiring platform
-where Mastercard is the applicable card network. It governs both card-present and
-card-not-present transaction streams.
+This policy applies to all merchants processed through Halyard Pay's acquiring platform where Mastercard is the applicable card network. It governs both card-present and card-not-present transaction streams.
+
+This policy specifically incorporates rules related to authentication processes, including the recently updated Mastercard requirements for Prolonged Authentication, which mandates initial multi-factor authentication, explicit cardholder consent, and limits the authentication window to five minutes.
 
 ## Required actions
 
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
-2. If the ratio meets or exceeds the threshold AND the minimum count is reached,
-   escalate the merchant account to human review immediately.
-3. Notify the acquiring compliance officer and document the case ID with supporting
-   transaction data.
-4. Track case progress until the account returns to threshold compliance or is
-   terminated.
+2. If the ratio meets or exceeds the threshold AND the minimum count is reached, escalate the merchant account to human review immediately.
+3. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+4. Track case progress until the account returns to threshold compliance or is terminated.
+5. Ensure ongoing monitoring includes verification that merchant authentication processes comply with Mastercard's Prolonged Authentication requirements to mitigate fraud risks effectively.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7 and §4.10.4.