Mastercard SPME §6 · Jun 2022 → May 2023

Control of instructions

substantive

The updated section now specifies technical and organizational measures required to ensure Personal Data processing aligns strictly with Controller Instructions, including contract clarity, formal commissioning via request forms, and Processor selection criteria, replacing a vague reference to automated decision-making or profiling.

Sources Mastercard SPME · Jun 2022 · page 11 PDF Mastercard SPME · May 2023 · page 11 PDF ATO Detection current
Also in §6.x this release breaking §6.3 Mastercard Counterfeit Card Fraud Loss Control Standards breaking §6.3.1 Counterfeit Card Notification substantive §6.2 Mastercard Fraud Loss Control Program Standards substantive §6.2.2 Acquirer Fraud Loss Control Programs
Why these edits? The update in section 6 clarifies specific technical and organizational measures to control personal data processing, impacting the obligations under Account-Takeover (ATO) Detection related to ensuring personal data is processed strictly per controller instructions.
Mastercard SPME §6
This section was substantively restructured between versions (5% text overlap). Compare the texts directly below.
Before · Jun 2022 · page 11

engages in automated decision-making or profiling in the context of the Covered Programs.

After · May 2023 · page 11

Technical and organizational measures to ensure that Personal Data are processed solely in accordance with the Instructions of the Controller include: – Unambiguous wording of the contract; – Formal commissioning (request form); – Criteria for selecting the Processor

Halyard Pay · 2 files
program: ATO Detection
authority: Mastercard SPME §6.2
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
- geo_anomaly
- device_fingerprint_change
- velocity_breach
- credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
+
+ # Updated to reflect Mastercard SPME §6 enhancements requiring formal agreements,
+ # explicit instructions, and selection criteria with data processors to ensure
+ # that personal data used in ATO detection is processed strictly per controller directives.

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements relies on real-time risk scoring on authentication events and enforces a mandatory 3DS (3-D Secure) challenge for any session sessions

where the computed risk score ¶ meets or risk exceeds the defined threshold. threshold, while ensuring all processing of personal data is in strict

accordance with controller instructions.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

  1. Evaluate each authentication event against the defined signal list signals in real time. time,

processing personal data strictly as directed by the controller.

  1. Compute a normalized risk score between 0.0 and 1.0.

  2. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

  1. Log all ATO signals and outcomes in the case management system. system, ensuring data

handling complies with formal commissioning and contractual agreements.

  1. Escalate persistent high-risk accounts to the ATO response team for manual review.

Source authority: Mastercard SPME §6.2.§6.2 and §6.

policies/ato_detection/policy.md — after applying change

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements relies on real-time risk scoring on authentication events and enforces a mandatory 3DS (3-D Secure) challenge for any session sessions

where the computed risk score ¶ meets or risk exceeds the defined threshold. threshold, while ensuring all processing of personal data is in strict

accordance with controller instructions.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

  1. Evaluate each authentication event against the defined signal list signals in real time. time,

processing personal data strictly as directed by the controller.

  1. Compute a normalized risk score between 0.0 and 1.0.

  2. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

  1. Log all ATO signals and outcomes in the case management system. system, ensuring data

handling complies with formal commissioning and contractual agreements.

  1. Escalate persistent high-risk accounts to the ATO response team for manual review.

Source authority: Mastercard SPME §6.2.§6.2 and §6.

Source authority: Mastercard SPME §6.

--- a/policies/ato_detection/rules.yaml
+++ b/policies/ato_detection/rules.yaml
@@ -11,3 +11,7 @@
 persistent_risk_escalation_threshold: 3
 persistent_risk_lookback_days: 7
 agent_owner: ato_agent
+
+# Updated to reflect Mastercard SPME §6 enhancements requiring formal agreements,
+# explicit instructions, and selection criteria with data processors to ensure
+# that personal data used in ATO detection is processed strictly per controller directives.
--- a/policies/ato_detection/policy.md
+++ b/policies/ato_detection/policy.md
@@ -2,9 +2,9 @@
 
 Account-takeover fraud occurs when a malicious actor gains unauthorized access to
 a cardholder's account and initiates transactions without the cardholder's consent.
-Halyard Pay implements real-time risk scoring on authentication events and enforces a
-mandatory 3DS (3-D Secure) challenge for any session where the computed risk score
-meets or exceeds the defined threshold.
+Halyard Pay relies on real-time risk scoring and enforces a mandatory 3DS (3-D Secure) challenge for sessions
+where the risk exceeds threshold, while ensuring all processing of personal data is in strict
+accordance with controller instructions.
 
 ## Detection signals
 
@@ -14,11 +14,13 @@
 
 ## Required actions
 
-1. Evaluate each authentication event against the defined signal list in real time.
+1. Evaluate each authentication event against the defined signals in real time,
+   processing personal data strictly as directed by the controller.
 2. Compute a normalized risk score between 0.0 and 1.0.
 3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before
-   authorizing the transaction.
-4. Log all ATO signals and outcomes in the case management system.
+authorizing the transaction.
+4. Log all ATO signals and outcomes in the case management system, ensuring data
+   handling complies with formal commissioning and contractual agreements.
 5. Escalate persistent high-risk accounts to the ATO response team for manual review.
 
-Source authority: Mastercard SPME §6.2.
+Source authority: Mastercard SPME §6.2 and §6.