Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §4.10 · Jun 2022 → May 2023

Multi-Factor Authentication Methods for Remote Commerce

substantive

The section adds guidelines allowing implementing cardholder authentication technologies for remote commerce using two or more factors from different categories, subject to regulatory approval and compliance with applicable laws.

Sources Mastercard SPME · Jun 2022 PDF Mastercard SPME · May 2023 · page 52 PDF Fraud Monitoring current
Also in §4.x this release substantive §4.10.1 Security Evaluation of Multi-Factor Authentication Methods substantive §4.10.3 Persistent Authentication substantive §4.10.4 Prolonged Authentication substantive §4.10.6 Use of a Vendor
Why these edits? The updated Mastercard SPME section 4.10 introduces multi-factor authentication requirements for remote commerce, impacting fraud monitoring efforts to verify authorized cardholders using multiple authentication factors as per the new standards.
Mastercard SPME §4.10
This section was substantively restructured between versions (0% text overlap). Compare the texts directly below.
Before · Jun 2022
After · May 2023 · page 52

Token Transactions Subject to any regulatory approvals and compliance with applicable laws and regulation, Cardholder authentication technologies may be implemented by an entity (herein, the "Authenticating Entity") in remote commerce use cases, to verify a person as an authorized Cardholder based on the use of two or more authentication factors. Each factor must belong to one of the three following categories, with no more than one authentication factor coming from any one category. Terminal, PIN, and MFA Method Security Standards

Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7


+ authority: Mastercard SPME §3.7, §4.10


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


+ mfa_compliance_required: true  # aligns with SPME §4.10 multi-factor authentication standards


+ mfa_factor_categories_limit: 1  # restrict to one factor per category as per SPME §4.10


+ 


+ # Incorporating multi-factor authentication directives from Mastercard SPME §4.10 to enhance fraud detection by verifying authorized cardholders with multiple authentication factors in remote commerce use cases.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

  1. Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

  1. Track case progress until the account returns to threshold compliance or is

terminated.

5. For remote commerce transactions, ensure multi-factor authentication (MFA) methods are verified wherever applicable, consistent with Mastercard SPME §4.10 requirements for authenticating authorized cardholders using at least two authentication factors from different categories.

Source authority: Mastercard SPME §3.7.§3.7, §4.10.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

  1. Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

  1. Track case progress until the account returns to threshold compliance or is

terminated.

5. For remote commerce transactions, ensure multi-factor authentication (MFA) methods are verified wherever applicable, consistent with Mastercard SPME §4.10 requirements for authenticating authorized cardholders using at least two authentication factors from different categories.

Source authority: Mastercard SPME §3.7.§3.7, §4.10.

Source authority: Mastercard SPME §4.10.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §4.10
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,7 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+mfa_compliance_required: true  # aligns with SPME §4.10 multi-factor authentication standards
+mfa_factor_categories_limit: 1  # restrict to one factor per category as per SPME §4.10
+
+# Incorporating multi-factor authentication directives from Mastercard SPME §4.10 to enhance fraud detection by verifying authorized cardholders with multiple authentication factors in remote commerce use cases.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -21,5 +21,6 @@
    transaction data.
 4. Track case progress until the account returns to threshold compliance or is
    terminated.
+5. For remote commerce transactions, ensure multi-factor authentication (MFA) methods are verified wherever applicable, consistent with Mastercard SPME §4.10 requirements for authenticating authorized cardholders using at least two authentication factors from different categories.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §4.10.