Mastercard SPME §9.3 · Jun 2022 → May 2023

General Monitoring Requirements

substantive

The updated section adds specific guidance that merchants should use temporary BIN blocking when fraud is evident and requires acquirers to ensure merchants comply with the fraud control standards in Chapter 6, extending current monitoring obligations to include these additional fraud control measures.

Sources Mastercard SPME · Jun 2022 · page 94 PDF Mastercard SPME · May 2023 · page 102 PDF Fraud Monitoring current

Also in §9.x this release breaking §9.2.1 Merchant Registration Fees and Noncompliance Assessments breaking §9.4.1 Non-face-to-face Adult Content and Services Merchants substantive §9.4.2 Non–face-to-face Gambling Merchants substantive §9.4.3 Pharmaceutical and Tobacco Product Merchants substantive §9.4.6 High-Risk Cyberlocker Merchants substantive §9.4.7 Recreational Cannabis Merchants (Canada Region Only)

Why these edits? Section 9.3 now explicitly requires merchants to implement temporary BIN blocking when fraud is evident and mandates acquirers to enforce compliance with fraud control standards outlined in Chapter 6, expanding the existing monitoring obligations for fraud detection and prevention.

Mastercard SPME §9.3

The monitoring requirements described in this section apply to Customers that acquire non-face-to-face adult content and services Transactions, ~~non–face-toface~~ non–face-to- face gambling Transactions, non–face-to-face pharmaceutical and tobacco product ¶ Transactions, government-owned lottery Transactions, skill games Transactions, ¶ certain cyberlocker Transactions, recreational cannabis Transactions (Canada ¶ Region only), certain securities Transactions, cryptocurrency Transactions, or ¶ negative option billing Transactions: • The Acquirer must ensure that each such Merchant implements real-time and batch procedures to monitor continually all of the following: – Simultaneous multiple Transactions using the same Account number – Consecutive or excessive attempts using the same Account number When attempted fraud is evident, a Merchant should implement temporary bank identification number (BIN) blocking as a fraud deterrent. • The Acquirer must ensure that each such Merchant complies with the fraud control Standards in Chapter 6 of this manual. Mastercard Registration Program

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7
+ authority: Mastercard SPME §3.7, §9.3
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
+   - recommend_temporary_bin_blocking
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
+ 
+ # Added requirement to recommend temporary BIN blocking when attempted fraud is identified,
+ # and updated authority to include the new Section 9.3 mandates regarding fraud control standards and monitoring enhancements.
+ # Included directive that acquirers must ensure merchants comply with fraud control standards from Chapter 6.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

Specific enhanced monitoring requirements also apply to merchants engaged in higher-risk and sensitive categories including non-face-to-face adult content and services, gambling, pharmaceuticals, tobacco products, government-owned lottery transactions, skill games, certain cyberlocker services, recreational cannabis in Canada, certain securities transactions, cryptocurrency transactions, or negative option billing.

## Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

Track case progress until the account returns to threshold compliance or is

terminated.

5. For merchants in the specified higher-risk categories, ensure real-time and batch monitoring for:

- Simultaneous multiple transactions using the same account number.

- Consecutive or excessive transaction attempts using the same account number.

6. Where attempted fraud is evident in these categories, implement temporary bank identification number (BIN) blocking as a fraud deterrent.

7. Confirm merchant compliance with the fraud control standards detailed in Chapter 6 of the Mastercard SPME manual.

Source authority: Mastercard SPME ~~§3.7.~~§3.7 and §9.3.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity on a monthly basis to detect patterns that

exceed Mastercard's acceptable fraud-to-sales thresholds. A merchant whose rolling

monthly fraud-to-sales ratio meets or exceeds 1.5% (0.015) and whose fraud count

reaches at least 100 transactions in that same month triggers mandatory escalation

under this policy.

When this policy applies

This policy applies to all merchants processed through Halyard Pay's acquiring platform

where Mastercard is the applicable card network. It governs both card-present and

card-not-present transaction streams.

## Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds the threshold AND the minimum count is reached,

escalate the merchant account to human review immediately.

Notify the acquiring compliance officer and document the case ID with supporting

transaction data.

Track case progress until the account returns to threshold compliance or is

terminated.

5. For merchants in the specified higher-risk categories, ensure real-time and batch monitoring for:

- Simultaneous multiple transactions using the same account number.

- Consecutive or excessive transaction attempts using the same account number.

6. Where attempted fraud is evident in these categories, implement temporary bank identification number (BIN) blocking as a fraud deterrent.

7. Confirm merchant compliance with the fraud control standards detailed in Chapter 6 of the Mastercard SPME manual.

Source authority: Mastercard SPME ~~§3.7.~~§3.7 and §9.3.

Source authority: Mastercard SPME §9.3.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,11 +1,16 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7
+authority: Mastercard SPME §3.7, §9.3
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
 escalation_actions:
   - escalate_to_human_review
   - notify_acquirer
+  - recommend_temporary_bin_blocking
 lookback_period_months: 1
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
+
+# Added requirement to recommend temporary BIN blocking when attempted fraud is identified,
+# and updated authority to include the new Section 9.3 mandates regarding fraud control standards and monitoring enhancements.
+# Included directive that acquirers must ensure merchants comply with fraud control standards from Chapter 6.

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -12,6 +12,8 @@
 where Mastercard is the applicable card network. It governs both card-present and
 card-not-present transaction streams.
 
+Specific enhanced monitoring requirements also apply to merchants engaged in higher-risk and sensitive categories including non-face-to-face adult content and services, gambling, pharmaceuticals, tobacco products, government-owned lottery transactions, skill games, certain cyberlocker services, recreational cannabis in Canada, certain securities transactions, cryptocurrency transactions, or negative option billing.
+
 ## Required actions
 
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
@@ -21,5 +23,10 @@
    transaction data.
 4. Track case progress until the account returns to threshold compliance or is
    terminated.
+5. For merchants in the specified higher-risk categories, ensure real-time and batch monitoring for:
+   - Simultaneous multiple transactions using the same account number.
+   - Consecutive or excessive transaction attempts using the same account number.
+6. Where attempted fraud is evident in these categories, implement temporary bank identification number (BIN) blocking as a fraud deterrent.
+7. Confirm merchant compliance with the fraud control standards detailed in Chapter 6 of the Mastercard SPME manual.
 
-Source authority: Mastercard SPME §3.7.
+Source authority: Mastercard SPME §3.7 and §9.3.