Mastercard SPME §5.1.2 · Jun 2022 → May 2023

ATM Card Retention

substantive

New requirements specify that ATM card retention must occur only upon issuer's command, with exceptions for terminal malfunctions or cardholder errors. If unclear within 2 business days, the card is presumed retained by issuer command. Acquirers must honor card capture commands from any issuer and provide completion messages reflecting actions taken.

Sources Mastercard SPME · Jun 2022 PDF Mastercard SPME · May 2023 · page 60 PDF Fraud Monitoring current

Also in §5.x this release substantive §5 Entry control

Why these edits? The new requirement that ATM card retention occur only at the issuer’s command, with specific criteria for handling exceptions and completion messages, directly impacts fraud monitoring processes for card capture events.

Mastercard SPME §5.1.2

This section was substantively restructured between versions (0% text overlap). Compare the texts directly below.

Before · Jun 2022

After · May 2023 · page 60

Card retention must occur only at the Issuer’s command. Cards captured because of ATM Terminal malfunction or Cardholder error, over which the ATM Terminal owner has no control, are the only allowable exceptions. If the ATM Acquirer cannot determine within two business days if a Card was captured because of a machine malfunction, Cardholder error, or a command sent by the Issuer, the Card will be deemed to be a Card captured on command of the Issuer. Card Recovery and Return Standards 5.1.1.2 Returning Counterfeit Cards Security Rules and Procedures—Merchant Edition • 7 February 2023

An ATM Terminal Acquirer that as an Issuer sends Card capture commands must honor the commands sent by other Issuers at all of its ATMs that are capable of Card capture. In the Europe Region, the Acquirer of any ATM Terminal capable of Card capture must honor the Card capture commands sent by any Issuer. Completion messages must indicate, to the best knowledge of the Acquirer, the action taken by the ATM for each Card capture request. 5.1.2.1 Handling ATM-Retained Cards An ATM Terminal Acquirer must handle retained Cards in accordance with the following requirements:

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME §3.7, §5.1.2
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ 
+ # Added reference to Mastercard SPME §5.1.2 reflecting new requirements that ATM card retention occur only on issuer's command, with exceptions and completion message obligations affecting fraud monitoring on card captures.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction ~~streams.~~ streams, including those involving ATM terminals capable of card capture.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

For ATM terminal-related fraud involving card retention, verify that retention

occurred only at the Issuer's command, with exceptions limited to ATM malfunctions or

cardholder errors as per Mastercard standards.

4. If the cause of ATM card capture is unclear within two business days, treat the

retention as issuer-commanded.

5. Notify the acquiring compliance officer and document the case ID with supporting

transaction and card capture data.

4. 6. Track case progress until the account returns to threshold compliance or is

terminated.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §5.1.2.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction ~~streams.~~ streams, including those involving ATM terminals capable of card capture.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

For ATM terminal-related fraud involving card retention, verify that retention

occurred only at the Issuer's command, with exceptions limited to ATM malfunctions or

cardholder errors as per Mastercard standards.

4. If the cause of ATM card capture is unclear within two business days, treat the

retention as issuer-commanded.

5. Notify the acquiring compliance officer and document the case ID with supporting

transaction and card capture data.

4. 6. Track case progress until the account returns to threshold compliance or is

terminated.

Source authority: Mastercard SPME ~~§3.7.~~§3.7, §5.1.2.

Source authority: Mastercard SPME §5.1.2.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §5.1.2
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -9,3 +9,5 @@
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+
+# Added reference to Mastercard SPME §5.1.2 reflecting new requirements that ATM card retention occur only on issuer's command, with exceptions and completion message obligations affecting fraud monitoring on card captures.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -10,16 +10,21 @@
 
 This policy applies to all merchants processed through Halyard Pay's acquiring platform
 where Mastercard is the applicable card network. It governs both card-present and
-card-not-present transaction streams.
+card-not-present transaction streams, including those involving ATM terminals capable of card capture.
 
 ## Required actions
 
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
 2. If the ratio meets or exceeds the threshold AND the minimum count is reached,
    escalate the merchant account to human review immediately.
-3. Notify the acquiring compliance officer and document the case ID with supporting
-   transaction data.
-4. Track case progress until the account returns to threshold compliance or is
+3. For ATM terminal-related fraud involving card retention, verify that retention
+   occurred only at the Issuer's command, with exceptions limited to ATM malfunctions or
+   cardholder errors as per Mastercard standards.
+4. If the cause of ATM card capture is unclear within two business days, treat the
+   retention as issuer-commanded.
+5. Notify the acquiring compliance officer and document the case ID with supporting
+   transaction and card capture data.
+6. Track case progress until the account returns to threshold compliance or is
    terminated.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7, §5.1.2.