Mastercard SPME §10.6.5 · May 2023 → Sep 2023

Determination of Fraud Recovery (FR)

substantive

The updated text clarifies when Mastercard will not assess fraud recovery for compromised U.S. Merchants using Hybrid POS Terminals, adding an effective date (1 October 2015) and specifying that this applies if certain transaction and event criteria are met. The calculation method for annual transaction count and rules for other regions remain largely unchanged.

Sources Mastercard SPME · May 2023 · page 134 PDF Mastercard SPME · Sep 2023 · page 124 PDF Chargeback Handling current
Also in §10.x this release substantive §10 Should the responsible Customer cause a PFI to conduct an examination, the responsible substantive §10.2 Policy Concerning Account Data Compromise Events and Potential Account Data substantive §10.3 Responsibilities in Connection with ADC Events and Potential ADC Events substantive §10.3.1 Time-Specific Procedures for ADC Events and Potential ADC Events substantive §10.3.2 Ongoing Procedures for ADC Events and Potential ADC Events substantive §10.6.2 Potential Reduction of Financial Responsibility substantive §10.7 Assessments and/or Disqualification for Noncompliance
Why these edits? The update clarifies conditions under which Mastercard will not assess Fraud Recovery for U.S. Merchants using Hybrid POS Terminals, directly impacting the chargeback handling obligations related to fraud recovery determinations.
Mastercard SPME §10.6.5
Security Rules and Procedures—Merchant Edition • 7 February 1 August 2023 within the scope of the ADC Event were processed through Hybrid POS Terminals; and (iii) the Merchant has not been identified by Mastercard as having experienced a different ADC Event during the twelve (12) months prior to the date of publication of the earliest ADC Alert for the subject ADC Event; and (iv) Mastercard determines that the Merchant was not storing Sensitive Authentication Data; or 2. Effective 1 October 2015, not assess FR if the compromised entity is a U.S. Region Acquirer’s Merchant located in the U.S. Region and Mastercard determines that (i) at least ninety-five percent (95%) of the Merchant’s annual total Transaction count was acquired through Hybrid POS Terminals; and (ii) at least ninety-five percent (95%) of the Transactions deemed by Mastercard to be within the scope of the ADC Event were acquired through Hybrid POS Terminals; and (iii) the Merchant has not been identified by Mastercard as having experienced a different ADC Event during the twelve (12) months prior ¶ to the to the date of publication of the earliest ADC Alert for the subject ADC Event; and (iv) Mastercard determines that the Merchant was not storing Sensitive Authentication Data. For purposes of this subsection, a Merchant’s annual total Transaction count is determined based on the Merchant’s clearing Transactions processed during the twelve (12) months prior to the date of publication of the ADC Alert through the GCMS. Transactions not processed by Mastercard are included in the annual Transaction count only if data pertaining to such Transactions is readily available to Mastercard. In the event that Mastercard is unable to readily determine the Merchant’s actual annual total Transaction count, Mastercard may exercise its judgment to determine an annual total Transaction count. Mastercard may require an Acquirer to provide information to Mastercard for that purpose. All Regions Other than the U.S. Region—For an ADC Event investigation opened by ¶ Mastercard Mastercard on or after 1 December 2014, Mastercard will determine FR in the manner set forth in the subsection above pertaining to the U.S. Region, provided the requisite percentage of processed Transactions were processed through Hybrid POS Terminals.
Halyard Pay · 2 files
program: Chargeback Handling
- authority: Mastercard SPME §10.1 and §11.5
+ authority: Mastercard SPME §10.1, §10.6.5, and §11.5
acknowledgement_business_days: 1
lifecycle_states:
- first_presentment
- chargeback
- second_presentment
- pre_arbitration
- arbitration
evidence_requirements:
first_presentment:
- transaction_receipt
- authorization_record
chargeback:
- merchant_rebuttal_letter
- delivery_confirmation
- customer_communication
second_presentment:
- compelling_evidence
- signed_cardholder_agreement
pre_arbitration:
- full_dispute_record
- prior_correspondence
arbitration:
- full_dispute_record
- arbitration_filing
agent_owner: chargeback_agent
 
- # Updated to reflect refined definitions and thresholds relating to laundering, excessive chargebacks, fraudulent transactions, and bankruptcy as defined in Mastercard SPME §11.5 (2023 edition).
- # These criteria impact evaluation triggers and risk assessment during chargeback handling.
+ # Revised authority to include Mastercard SPME §10.6.5 update regarding Fraud Recovery assessment exceptions for U.S. Merchants using Hybrid POS Terminals.
+ # This impacts the evaluation of whether Fraud Recovery is applicable during chargeback handling.
+
+ # The policy reflects criteria that Mastercard uses to determine when Fraud Recovery will not be assessed,
+ # specifically incorporating the condition that U.S. Acquirer Merchants with at least 95% of annual and event-related
+ # transaction volume processed through Hybrid POS Terminals and no prior ADC Event within 12 months, and not storing
+ # Sensitive Authentication Data, are exempt from Fraud Recovery assessment.
+

Chargeback Handling

Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, as the acquirer, manages the entire dispute lifecycle for its merchants, from initial first presentment through arbitration, in compliance with Mastercard's requirements.

Lifecycle overview

Disputes move through defined stages: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Adherence to strict evidence requirements and deadlines at each stage is critical to avoid automatic rulings against the acquirer.

Required actions

  1. Acknowledge each incoming chargeback within one business day.

  2. Collect the necessary evidence based on the current lifecycle stage.

  3. Submit second presentments when merchant liability is disputable, providing strong supporting evidence.

  4. Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.

  5. Maintain full case documentation for audits and reporting.

Monitoring and Risk Factors

Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy.

Regarding Fraud Recovery (FR) assessments for merchants involved in Account Data Compromise (ADC) events, Mastercard has clarified that merchants in the U.S. using Hybrid POS Terminals meeting specified criteria—such as at least 95% of their transactions acquired through such terminals and no prior ADC events in the preceding 12 months—may not be assessed FR. This affects the handling and evaluation of fraud-related chargebacks and the associated recovery processes.

These refined definitions and conditions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.

Source authority: Mastercard SPME §§10.1, 10.6.5, 11.5.

policies/chargeback_handling/policy.md — after applying change

Chargeback Handling

Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, as the acquirer, manages the entire dispute lifecycle for its merchants, from initial first presentment through arbitration, in compliance with Mastercard's requirements.

Lifecycle overview

Disputes move through defined stages: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Adherence to strict evidence requirements and deadlines at each stage is critical to avoid automatic rulings against the acquirer.

Required actions

  1. Acknowledge each incoming chargeback within one business day.

  2. Collect the necessary evidence based on the current lifecycle stage.

  3. Submit second presentments when merchant liability is disputable, providing strong supporting evidence.

  4. Only escalate to pre-arbitration and arbitration after issuer rejection of the second presentment.

  5. Maintain full case documentation for audits and reporting.

Monitoring and Risk Factors

Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy.

Regarding Fraud Recovery (FR) assessments for merchants involved in Account Data Compromise (ADC) events, Mastercard has clarified that merchants in the U.S. using Hybrid POS Terminals meeting specified criteria—such as at least 95% of their transactions acquired through such terminals and no prior ADC events in the preceding 12 months—may not be assessed FR. This affects the handling and evaluation of fraud-related chargebacks and the associated recovery processes.

These refined definitions and conditions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.

Source authority: Mastercard SPME §§10.1, 10.6.5, 11.5.

Source authority: Mastercard SPME §10.6.5.

--- a/policies/chargeback_handling/rules.yaml
+++ b/policies/chargeback_handling/rules.yaml
@@ -1,5 +1,5 @@
 program: Chargeback Handling
-authority: Mastercard SPME §10.1 and §11.5
+authority: Mastercard SPME §10.1, §10.6.5, and §11.5
 acknowledgement_business_days: 1
 lifecycle_states:
   - first_presentment
@@ -26,5 +26,11 @@
     - arbitration_filing
 agent_owner: chargeback_agent
 
-# Updated to reflect refined definitions and thresholds relating to laundering, excessive chargebacks, fraudulent transactions, and bankruptcy as defined in Mastercard SPME §11.5 (2023 edition).
-# These criteria impact evaluation triggers and risk assessment during chargeback handling.+# Revised authority to include Mastercard SPME §10.6.5 update regarding Fraud Recovery assessment exceptions for U.S. Merchants using Hybrid POS Terminals.
+# This impacts the evaluation of whether Fraud Recovery is applicable during chargeback handling.
+
+# The policy reflects criteria that Mastercard uses to determine when Fraud Recovery will not be assessed,
+# specifically incorporating the condition that U.S. Acquirer Merchants with at least 95% of annual and event-related
+# transaction volume processed through Hybrid POS Terminals and no prior ADC Event within 12 months, and not storing
+# Sensitive Authentication Data, are exempt from Fraud Recovery assessment.
+

--- a/policies/chargeback_handling/policy.md
+++ b/policies/chargeback_handling/policy.md
@@ -18,6 +18,8 @@
 
 Halyard Pay monitors merchant risk factors including chargeback ratios, fraud rates, and financial stability. Updated Mastercard MATCH Listing Reason Codes define specific grounds for elevated scrutiny or match listing, including but not limited to laundering (presentation of invalid transaction records), excessive chargebacks (over 1% chargeback-to-sales ratio with minimum USD 5,000 monthly), excessive fraud (fraud-to-sales ratio of 8% or more including at least 10 fraudulent transactions totaling USD 5,000 or more), questionable merchant classification, and bankruptcy.
 
-These refined definitions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.
+Regarding Fraud Recovery (FR) assessments for merchants involved in Account Data Compromise (ADC) events, Mastercard has clarified that merchants in the U.S. using Hybrid POS Terminals meeting specified criteria—such as at least 95% of their transactions acquired through such terminals and no prior ADC events in the preceding 12 months—may not be assessed FR. This affects the handling and evaluation of fraud-related chargebacks and the associated recovery processes.
 
-Source authority: Mastercard SPME §§10.1, 11.5.+These refined definitions and conditions inform Halyard Pay's chargeback and risk management policies to ensure compliance and mitigate risk exposure.
+
+Source authority: Mastercard SPME §§10.1, 10.6.5, 11.5.