Mastercard SPME §6 · Jun 2022 → May 2023
Control of instructions
The updated section now specifies technical and organizational measures required to ensure Personal Data processing aligns strictly with Controller Instructions, including contract clarity, formal commissioning via request forms, and Processor selection criteria, replacing a vague reference to automated decision-making or profiling.
engages in automated decision-making or profiling in the context of the Covered Programs.
Technical and organizational measures to ensure that Personal Data are processed solely in accordance with the Instructions of the Controller include: – Unambiguous wording of the contract; – Formal commissioning (request form); – Criteria for selecting the Processor
program: ATO Detectionauthority: Mastercard SPME §6.2risk_threshold_for_3ds_challenge: 0.5risk_score_range: [0.0, 1.0]signals:- geo_anomaly- device_fingerprint_change- velocity_breach- credential_stuffingchallenge_method: 3ds_v2persistent_risk_escalation_threshold: 3persistent_risk_lookback_days: 7agent_owner: ato_agent++ # Updated to reflect Mastercard SPME §6 enhancements requiring formal agreements,+ # explicit instructions, and selection criteria with data processors to ensure+ # that personal data used in ATO detection is processed strictly per controller directives.
Account-Takeover (ATO) Detection
Account-takeover fraud occurs when a malicious actor gains unauthorized access to
a cardholder's account and initiates transactions without the cardholder's consent.
Halyard Pay implements relies on real-time risk scoring on authentication events and enforces a ¶ mandatory 3DS (3-D Secure) challenge for any session sessions
where the computed risk score ¶ meets or risk exceeds the defined threshold. threshold, while ensuring all processing of personal data is in strict
accordance with controller instructions.
Detection signals
The risk model incorporates multiple behavioral signals: geographic anomalies
inconsistent with a cardholder's established pattern, changes to device fingerprint,
transaction velocity breaches, and indicators of credential-stuffing activity.
Required actions
- Evaluate each authentication event against the defined
signal listsignals in realtime.time,
processing personal data strictly as directed by the controller.
-
Compute a normalized risk score between 0.0 and 1.0.
-
If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before
authorizing the transaction.
- Log all ATO signals and outcomes in the case management
system.system, ensuring data
handling complies with formal commissioning and contractual agreements.
- Escalate persistent high-risk accounts to the ATO response team for manual review.
Source authority: Mastercard SPME §6.2.§6.2 and §6.
Account-Takeover (ATO) Detection
Account-takeover fraud occurs when a malicious actor gains unauthorized access to
a cardholder's account and initiates transactions without the cardholder's consent.
Halyard Pay implements relies on real-time risk scoring on authentication events and enforces a ¶ mandatory 3DS (3-D Secure) challenge for any session sessions
where the computed risk score ¶ meets or risk exceeds the defined threshold. threshold, while ensuring all processing of personal data is in strict
accordance with controller instructions.
Detection signals
The risk model incorporates multiple behavioral signals: geographic anomalies
inconsistent with a cardholder's established pattern, changes to device fingerprint,
transaction velocity breaches, and indicators of credential-stuffing activity.
Required actions
- Evaluate each authentication event against the defined
signal listsignals in realtime.time,
processing personal data strictly as directed by the controller.
-
Compute a normalized risk score between 0.0 and 1.0.
-
If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before
authorizing the transaction.
- Log all ATO signals and outcomes in the case management
system.system, ensuring data
handling complies with formal commissioning and contractual agreements.
- Escalate persistent high-risk accounts to the ATO response team for manual review.
Source authority: Mastercard SPME §6.2.§6.2 and §6.
Source authority: Mastercard SPME §6.
--- a/policies/ato_detection/rules.yaml +++ b/policies/ato_detection/rules.yaml @@ -11,3 +11,7 @@ persistent_risk_escalation_threshold: 3 persistent_risk_lookback_days: 7 agent_owner: ato_agent + +# Updated to reflect Mastercard SPME §6 enhancements requiring formal agreements, +# explicit instructions, and selection criteria with data processors to ensure +# that personal data used in ATO detection is processed strictly per controller directives. --- a/policies/ato_detection/policy.md +++ b/policies/ato_detection/policy.md @@ -2,9 +2,9 @@ Account-takeover fraud occurs when a malicious actor gains unauthorized access to a cardholder's account and initiates transactions without the cardholder's consent. -Halyard Pay implements real-time risk scoring on authentication events and enforces a -mandatory 3DS (3-D Secure) challenge for any session where the computed risk score -meets or exceeds the defined threshold. +Halyard Pay relies on real-time risk scoring and enforces a mandatory 3DS (3-D Secure) challenge for sessions +where the risk exceeds threshold, while ensuring all processing of personal data is in strict +accordance with controller instructions. ## Detection signals @@ -14,11 +14,13 @@ ## Required actions -1. Evaluate each authentication event against the defined signal list in real time. +1. Evaluate each authentication event against the defined signals in real time, + processing personal data strictly as directed by the controller. 2. Compute a normalized risk score between 0.0 and 1.0. 3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before - authorizing the transaction. -4. Log all ATO signals and outcomes in the case management system. +authorizing the transaction. +4. Log all ATO signals and outcomes in the case management system, ensuring data + handling complies with formal commissioning and contractual agreements. 5. Escalate persistent high-risk accounts to the ATO response team for manual review. -Source authority: Mastercard SPME §6.2. +Source authority: Mastercard SPME §6.2 and §6.