Mastercard SPME §10.3.1 · May 2023 → Sep 2023
Time-Specific Procedures for ADC Events and Potential ADC Events
The procedures now require the Payment Forensic Investigator (PFI) to submit preliminary and final forensic reports within specified timeframes, prohibit Customers from interfering with the independence and integrity of the investigation, and allow Mastercard to engage a PFI directly at the Customer's expense to expedite investigations.
an examination, the responsible Customer must notify Mastercard within 24 hours of the engagement of the PFI. Failure to notify Mastercard within the 24-hour time frame may result in a noncompliance assessment as described in section 10.7. Alternatively, and provided the responsible Customer determines that Criterion C is satisfied, the responsible Customer itself may elect to investigate the Event in lieu of causing a PFI to conduct an examination of the Merchant or other Agent. If the responsible Customer itself elects to conduct the investigation, not later than twenty (20) business days following the date of the notice by Mastercard described above, the responsible Customer must provide to Mastercard that all of the following are true:
- The responsible Customer elected to investigate the ADC Event or Potential ADC Event in lieu of causing a PFI to investigate the ADC Event or Potential ADC Event; and
- The Merchant (or other Agent) that is the subject of the ADC Event or Potential ADC Event does not use a computer-based acceptance system that is used by another Merchant (or Agent) or is connected to Merchants (or Agents) or third parties; and
- The responsible Customer’s investigation of the ADC Event or Potential ADC Event has been completed and the ADC Event or Potential ADC Event has been fully contained. Documentation satisfactory to Mastercard confirming such containment (including the date of containment) and a written explanation of how the security event was contained (including the steps taken to ensure that Account data are no longer at risk of compromise) must be provided to Mastercard; and
- The Merchant has newly validated, or revalidated or has a road map to achieve compliance with the PCI DSS. Documentation confirming such validation or revalidation must be provided to Mastercard upon completion of the investigation. Failure to comply with any obligation of the responsible Customer may result in the imposition of a noncompliance assessment as described in section 10.7. Mastercard may conduct periodic reviews of an ADC Event or Potential ADC Event investigated by the responsible Customer to confirm that the Event has been fully contained. Should Mastercard determine that an Event continues to place Account Data Compromise Events
Security Rules and Procedures—Merchant Edition • 1 August 2023
- Within five (5) business days from the commencement of the forensic investigation, ensure that the PFI submits to Mastercard a preliminary forensic report detailing all investigative findings to date.
- Within ten (10) business days from the end of the PFI investigation, provide to Mastercard a final forensic report detailing all findings, conclusions, and recommendations of the PFI, continue to address any outstanding exposure, and implement all recommendations until the ADC Event or Potential ADC Event is resolved to the satisfaction of Mastercard. In connection with the independent forensic investigation and preparation of the final forensic report, no Customer may engage in or enter into (or permit an Agent to engage in or enter into) any conduct, agreement, or understanding that would impair the completeness, accuracy, or objectivity of any aspect of the forensic investigation or final forensic report. The Customer shall not engage in any conduct (or permit an Agent to engage in any conduct) that could or would influence, or undermine the independence of, the PFI or undermine the reliability or integrity of the forensic investigation or final forensic report. By way of example, and not limitation, a Customer must not itself, or permit any of its Agents to, take any action or fail to take any action that would have the effect of:
- precluding, prohibiting, or inhibiting the PFI from communicating directly with Mastercard;
- permitting a Customer or its Agent to substantively edit or otherwise alter the forensic report; or
- directing the PFI to withhold information from Mastercard. Notwithstanding the foregoing, Mastercard may engage a PFI on behalf of the Customer in order to expedite the investigation. The Customer on whose behalf the PFI is so engaged will be responsible for all costs associated with the investigation.
program: Chargeback Handling- authority: Mastercard SPME §10.1 and §11.5+ authority: Mastercard SPME §10.1, §10.3.1, and §11.5acknowledgement_business_days: 1lifecycle_states:- first_presentment- chargeback- second_presentment- pre_arbitration- arbitrationevidence_requirements:first_presentment:- transaction_receipt- authorization_recordchargeback:- merchant_rebuttal_letter- delivery_confirmation- customer_communicationsecond_presentment:- compelling_evidence- signed_cardholder_agreementpre_arbitration:- full_dispute_record- prior_correspondencearbitration:- full_dispute_record- arbitration_filingagent_owner: chargeback_agent# Updated to reflect refined definitions and thresholds relating to laundering, excessive chargebacks, fraudulent transactions, and bankruptcy as defined in Mastercard SPME §11.5 (2023 edition).- # These criteria impact evaluation triggers and risk assessment during chargeback handling.+ # Also incorporates new forensic investigation reporting timeframes and independence requirements mandated by Mastercard SPME §10.3.1 (2023 edition).+ # These affect chargeback investigations and obligations related to Account Data Compromise Events.++ # Regarding Account Data Compromise (ADC) Event investigations under Mastercard SPME §10.3.1:+ # - Payment Forensic Investigators (PFIs) engaged must submit a preliminary forensic report within 5 business days from investigation commencement.+ # - A final forensic report is required within 10 business days following the conclusion of the PFI's investigation, including findings, conclusions, and recommendations.+ # - Merchants and Customers must not interfere with the independence or completeness of the forensic investigation or reports, including prohibitions on editing reports, restricting PFI communication with Mastercard, or influencing investigation outcomes.+ # - Mastercard retains the right to engage PFIs directly and the relevant Customer remains financially responsible.++ # These requirements supplement existing obligations related to investigation and documentation retention in chargeback handling workflows.
Chargeback Handling
Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, as the acquirer, manages the entire dispute lifecycle for its merchants, from initial first presentment through arbitration, in compliance with Mastercard's requirements.
Lifecycle overview
Disputes move through defined stages: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Adherence to strict evidence requirements and deadlines at each stage is critical to avoid automatic rulings against the acquirer.
Required actions
-
Acknowledge each incoming chargeback within one business day.
-
Collect the necessary evidence based on the current lifecycle stage.
-
Submit second presentments when merchant liability is disputable, providing strong supporting evidence.
-
Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.
-
Maintain full case documentation for audits and reporting.
Monitoring and Risk Factors
Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy.
In addition, for any Account Data Compromise (ADC) event, Halyard Pay follows Mastercard's enhanced requirements from SPME §10.3.1: a Payment Forensic Investigator (PFI) must submit a preliminary forensic report within 5 business days of investigation start and a final report within 10 business days after investigation completion, detailing findings and recommendations. Halyard Pay ensures no party impairs the objectivity or independence of the forensic investigation or report, including prohibiting actions that influence or restrict the PFI's communication with Mastercard or the integrity of the reports. Halyard Pay also assumes responsibility for timely investigations to fully contain ADC events and implements required remediation measures.
These refined definitions and procedural enhancements inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.
Source authority: Mastercard SPME §§10.1, 10.3.1, 11.5.
Chargeback Handling
Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, as the acquirer, manages the entire dispute lifecycle for its merchants, from initial first presentment through arbitration, in compliance with Mastercard's requirements.
Lifecycle overview
Disputes move through defined stages: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Adherence to strict evidence requirements and deadlines at each stage is critical to avoid automatic rulings against the acquirer.
Required actions
-
Acknowledge each incoming chargeback within one business day.
-
Collect the necessary evidence based on the current lifecycle stage.
-
Submit second presentments when merchant liability is disputable, providing strong supporting evidence.
-
Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.
-
Maintain full case documentation for audits and reporting.
Monitoring and Risk Factors
Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy.
In addition, for any Account Data Compromise (ADC) event, Halyard Pay follows Mastercard's enhanced requirements from SPME §10.3.1: a Payment Forensic Investigator (PFI) must submit a preliminary forensic report within 5 business days of investigation start and a final report within 10 business days after investigation completion, detailing findings and recommendations. Halyard Pay ensures no party impairs the objectivity or independence of the forensic investigation or report, including prohibiting actions that influence or restrict the PFI's communication with Mastercard or the integrity of the reports. Halyard Pay also assumes responsibility for timely investigations to fully contain ADC events and implements required remediation measures.
These refined definitions and procedural enhancements inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.
Source authority: Mastercard SPME §§10.1, 10.3.1, 11.5.
Source authority: Mastercard SPME §10.3.1.
--- a/policies/chargeback_handling/rules.yaml +++ b/policies/chargeback_handling/rules.yaml @@ -1,5 +1,5 @@ program: Chargeback Handling -authority: Mastercard SPME §10.1 and §11.5 +authority: Mastercard SPME §10.1, §10.3.1, and §11.5 acknowledgement_business_days: 1 lifecycle_states: - first_presentment @@ -27,4 +27,13 @@ agent_owner: chargeback_agent # Updated to reflect refined definitions and thresholds relating to laundering, excessive chargebacks, fraudulent transactions, and bankruptcy as defined in Mastercard SPME §11.5 (2023 edition). -# These criteria impact evaluation triggers and risk assessment during chargeback handling.+# Also incorporates new forensic investigation reporting timeframes and independence requirements mandated by Mastercard SPME §10.3.1 (2023 edition). +# These affect chargeback investigations and obligations related to Account Data Compromise Events. + +# Regarding Account Data Compromise (ADC) Event investigations under Mastercard SPME §10.3.1: +# - Payment Forensic Investigators (PFIs) engaged must submit a preliminary forensic report within 5 business days from investigation commencement. +# - A final forensic report is required within 10 business days following the conclusion of the PFI's investigation, including findings, conclusions, and recommendations. +# - Merchants and Customers must not interfere with the independence or completeness of the forensic investigation or reports, including prohibitions on editing reports, restricting PFI communication with Mastercard, or influencing investigation outcomes. +# - Mastercard retains the right to engage PFIs directly and the relevant Customer remains financially responsible. + +# These requirements supplement existing obligations related to investigation and documentation retention in chargeback handling workflows. --- a/policies/chargeback_handling/policy.md +++ b/policies/chargeback_handling/policy.md @@ -18,6 +18,8 @@ Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy. -These refined definitions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure. +In addition, for any Account Data Compromise (ADC) event, Halyard Pay follows Mastercard's enhanced requirements from SPME §10.3.1: a Payment Forensic Investigator (PFI) must submit a preliminary forensic report within 5 business days of investigation start and a final report within 10 business days after investigation completion, detailing findings and recommendations. Halyard Pay ensures no party impairs the objectivity or independence of the forensic investigation or report, including prohibiting actions that influence or restrict the PFI's communication with Mastercard or the integrity of the reports. Halyard Pay also assumes responsibility for timely investigations to fully contain ADC events and implements required remediation measures. -Source authority: Mastercard SPME §§10.1, 11.5.+These refined definitions and procedural enhancements inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure. + +Source authority: Mastercard SPME §§10.1, 10.3.1, 11.5.