program: ATO Detection
- authority: Mastercard SPME §6.2
+ authority: Mastercard SPME 6.2
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
+ 
+ # Updated per Mastercard SPME 6.2.2 requirements, including real-time alerts,
+ # trained fraud staff managing detection rules and cases, and capability to stop
+ # authorization flows in case of major fraud, emergency, or Mastercard request.

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements real-time risk scoring on authentication events and enforces a

mandatory 3DS (3-D Secure) challenge for any session where the computed risk score

meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

1. Evaluate each authentication event against the defined signal list in real time.

2. Compute a normalized risk score between 0.0 and 1.0.

3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

4. Log all ATO signals and outcomes in the case management system.

5. Escalate persistent high-risk accounts to the ATO response team for manual review.

## Alignment with Mastercard Fraud Loss Control Standards

Halyard Pay aligns with Mastercard SPME §6.2.2 requirements by operating a fraud loss control

program that produces real-time alerts and daily monitoring reports. Staff trained in

fraud detection write and manage detection rules to promptly identify and respond to

fraud patterns, including account takeover. The program supports mitigation measures

such as stopping authorization flows during major fraud incidents, ensuring rapid

investigation and response within prescribed timeframes.

Source authority: Mastercard SPME §6.2.§6.2 and §6.2.2.

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME §3.7, §6.2.2
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
- monitoring_cadence: monthly
+ monitoring_cadence: daily
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
+   - initiate_authorization_flow_stop
lookback_period_months: 1
remediation_review_interval_days: 30
+ alert_analysis_time_hours: 24
+ fraud_mitigation_deadline_hours: 72
+ strong_authentication_required: true
agent_owner: fraud_ops_agent
+ 
+ # The policy is updated to reflect Mastercard SPME §6.2.2 requirements:
+ # - Fraud monitoring must generate daily or real-time alerts.
+ # - Alerts and reports must be analyzed within 24 hours.
+ # - Fraud mitigation actions must be completed within 72 hours.
+ # - Acquirers must have the capability to stop authorization flows during major fraud.
+ # - Strong authentication controls (preferably two-factor) must be implemented.
+ # These augment existing fraud monitoring rules cited under §3.7.

Fraud Monitoring

Halyard Pay continuously monitors merchant fraud activity on to promptly identify and respond to potential fraud risks in accordance with Mastercard's standards. We maintain a monthly basis to detect patterns fraud loss control program that ¶ exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling ¶ monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count ¶ reaches at least 100 transactions in that same month triggers mandatory escalation ¶ under this policy. automatically generates daily reports and real-time alerts for suspicious merchant activity. Trained staff analyze these alerts and reports within 24 hours and implement mitigation measures within 72 hours of transaction occurrence to reduce fraud exposure.

When this policy applies

This policy applies to all merchants processed through via Halyard Pay's acquiring platform ¶ where Mastercard is the applicable card network. It governs covers both card-present and ¶ card-not-present transaction streams. transactions across all merchant types.

Required actions

1. Compute Generate and review daily fraud monitoring reports and real-time alerts for merchant transactions.

2. Analyze these data within 24 hours to detect unusual patterns such as increased authorization requests, high velocity transactions, or anomalies in card reading methods.

3. Calculate the merchant's rolling fraud-to-sales ratio each calendar month. ¶ 2. If the ratio meets or exceeds the threshold AND the monthly; escalate merchants exceeding a 1.5% fraud rate and a minimum count is reached, ¶ escalate the merchant account of 100 fraudulent transactions to human review immediately.

3. 4. Enforce strong authentication controls across the platform to ensure only authorized parties can initiate transactions, aligning with Mastercard Identity Check™ guidelines.

5. Implement immediate mitigating measures to halt fraudulent authorization flows where necessary, particularly in response to major fraud events or at Mastercard's request.

6. Notify the acquiring compliance officer and officer, document the case ID with supporting ¶ transaction data. ¶ 4. Track case details, and track resolution progress until the compliance thresholds are restored or the merchant account returns to threshold compliance or is ¶ terminated.

Source authority: Mastercard SPME §3.7.§§3.7, 6.2.2.