program: ATO Detection
- authority: Mastercard SPME §10.6.2.1
+ authority: Mastercard SPME 710.6.2.1, 72.2.6
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
 
- # This policy incorporates the updated Mastercard SPME §10.6.2.1 requirements,
- # including extended timelines for Terminal Servicer compliance revalidation
- # after an Account Data Compromise Event, emphasizing a 90-day PCI DSS
- # revalidation period and an added 12-month DESV appendix compliance.
- # It reinforces timely and comprehensive security procedures to mitigate
- # Account Takeover risk in line with Mastercard's updated security standards.
+ # This policy incorporates the Mastercard SPME updates to section 2.2.6,
+ # which now include explicit provisions for reclassifying Merchants with
+ # confirmed Account Data Compromise (ADC) Events as Level 1 Merchants.
+ # These merchants must comply with Level 1 validation and noncompliance
+ # assessments, reinforcing detection and risk management for Account
+ # Takeover incidents. The policy also retains requirements for Service
+ # Providers, including PCI DSS and DESV compliance timelines following ADC.
+ #
+ # These revisions align ATO risk mitigation measures with Mastercard's enhanced
+ # SDP reclassification and compliance enforcement framework, ensuring prompt
+ # risk escalation and comprehensive coverage for both Merchants and Service Providers.

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements real-time risk scoring on authentication events and enforces a

mandatory 3DS (3-D Secure) challenge for any session where the computed risk score

meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

1. Evaluate each authentication event against the defined signal list in real time.

2. Compute a normalized risk score between 0.0 and 1.0.

3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

4. Log all ATO signals and outcomes in the case management system.

5. Escalate persistent high-risk accounts to the ATO response team for manual review.

6. In the event of an Account Data Compromise (ADC), ensure that any Terminal Servicer

involved revalidates PCI DSS compliance within 90 calendar days after the forensic

investigation concludes, and demonstrate compliance with the PCI DSS Data

Encryption and Software Validation (DESV) appendix within 12 months, consistent

with Mastercard requirements (SPME §10.6.2.1).

7. Acknowledge that merchants with confirmed ADC events may be reclassified as Level 1

Merchants and must comply with all associated validation and compliance requirements,

reflecting Mastercard's updated compliance and noncompliance measures (SPME §2.2.6).

Source authority: Mastercard SPME §6.2, §10.6.2.1.§10.6.2.1, §2.2.6.

program: BRAM
- authority: Mastercard SPME §8.6.2, §10.2
+ authority: Mastercard SPME 2.2.6, 10.2
response_window_days: 180
required_evidence:
  - transaction_monitoring_records
  - corrective_action_plan
-   - police_report  # Added requirement for police report according to updated SPME §8.6.2
+   - police_report  # Retain police report requirement
halt_actions:
  - halt_new_merchant_onboarding
internal_notification_hours: 24
agent_owner: bram_response_agent
 
- # Updated to reflect the extended discretionary investigation period and mandatory police report inclusion for at least one coercion claim as specified in Mastercard SPME §8.6.2.
+ # Updated to include clarified noncompliance consequences for Service Providers with ADC Events, reclassification, and delisting per Mastercard SPME 2.2.6.
+ # This affects BRAM investigation response obligations as referenced in section 10.2.

BRAM Investigation Response

When Mastercard issues a Business Risk Assessment and Mitigation (BRAM) investigation ¶ notice for one of our merchants, the acquirer must halt new merchant onboarding ¶ immediately and submit an evidence package within one hundred eighty (180) days ¶ of receipt of the notice.

Required actions

1. Halt new merchant onboarding for the merchant under investigation.

2. Compile and submit an evidence package containing:

• Transaction monitoring records covering the prior 180 days.

• A written corrective action plan.

• Documentation of any police reports related to alleged coercion claims if applicable.

3. Notify the Halyard Pay Compliance lead within 24 hours of receipt.

Additional Considerations for Coercion Claims

When allegations of coerced Transactions arise, note that Mastercard may extend the usual 120-day ¶ investigation period at its discretion. At least one claim must include a police report from the Cardholder. ¶ Transactions reported as Lost or Stolen Fraud (fraud type codes 00 or 01) are subject to investigation, ¶ though Mastercard may consider other fraud codes. Mastercard will notify issuers with Transactions at the ¶ merchant within the investigation period to prompt claim submissions.

## Compliance Implications for Service Providers and Merchants

A confirmed Account Data Compromise (ADC) Event can trigger mandatory reclassification and escalated compliance obligations. Specifically:

- Any Service Provider experiencing a confirmed ADC Event, adverse inference, or noncooperation in forensic investigations will be reclassified as a Level 1 Service Provider and automatically removed from the Mastercard SDP Compliant Registered Service Provider List. Reinstatement requires revalidation of full PCI DSS compliance including the DESV appendix within twelve (12) months of compliance achievement.

- Similarly, any Merchant with a confirmed ADC Event may be reclassified to Level 1 Merchant status and must comply with all validation and noncompliance requirements for that level.

These measures underscore the critical need for full cooperation and timely remediation in BRAM investigations.

Source authority: Mastercard SPME §8.6.2, §10.2.§10.2, §2.2.6.