Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §3.11.3 · May 2023 → Sep 2023

Persistent Authentication

substantive

The updated section now explicitly requires the device used in persistent authentication to prompt the cardholder for explicit consent before a transaction, and mandates compliance with Mastercard Standards for consumer authentication technology, adding specific compliance and consent obligations.

Sources Mastercard SPME · May 2023 · page 40 PDF Mastercard SPME · Sep 2023 · page 38 PDF Fraud Monitoring current
Also in §3.x this release substantive §3.11 Consumer Device Cardholder Verification Methods substantive §3.11.7 Use of a Vendor substantive §3.13.2 Acquirer Information
Why these edits? The updated obligation for persistent authentication now requires explicit cardholder consent and compliance with Mastercard Standards for consumer authentication technology, directly impacting monitoring and security controls covered under Fraud Monitoring.
Mastercard SPME §3.11.3
This section was substantively restructured between versions (25% text overlap). Compare the texts directly below.
Before · May 2023 · page 40

Security Rules and Procedures—Merchant Edition • 7 February 2023

Mastercard requires testing and certification of proposed CDCVM functionality for persistent authentication with respect to the following:

After · Sep 2023 · page 38

Security Rules and Procedures—Merchant Edition • 1 August 2023

  1. The device has the capability to prompt for explicit Cardholder consent (for example, by requiring the Cardholder to click a button or tap on the device) before a Transaction may be effected; and
  2. The consumer authentication technology complies with Mastercard Standards.
Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7, §11.1.1


+ authority: Mastercard SPME 3.7, 11.1.1, 3.11.3


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


 


- # MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.


+ # MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME 11.1.1.


# Acquirers may add and search for information on up to five principal owners per Merchant.


# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.


# Retroactive alert processing is supported for data up to 360 days old.


# Acquirers control receipt and detail of inquiry match information.


# Real-time access via MATCH Online and API, and batch operations remain available.


# Merchant URL information may be added and searched.


# Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.


+ # Additionally, persistent authentication mechanisms employed in Fraud Monitoring must adhere to Mastercard requirement of explicit cardholder consent prompts and compliance with Mastercard Standards for authentication technology as per SPME 3.11.3.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Verify that persistent authentication mechanisms incorporate explicit cardholder consent and comply with Mastercard consumer authentication standards, as required by updated Mastercard SPME security rules.

6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

6. 7. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7 §3.7, §3.11.3, and §11.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Verify that persistent authentication mechanisms incorporate explicit cardholder consent and comply with Mastercard consumer authentication standards, as required by updated Mastercard SPME security rules.

6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

6. 7. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7 §3.7, §3.11.3, and §11.1.1.

Source authority: Mastercard SPME §3.11.3.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7, §11.1.1
+authority: Mastercard SPME 3.7, 11.1.1, 3.11.3
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -10,7 +10,7 @@
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
 
-# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.
+# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME 11.1.1.
 # Acquirers may add and search for information on up to five principal owners per Merchant.
 # Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.
 # Retroactive alert processing is supported for data up to 360 days old.
@@ -18,3 +18,4 @@
 # Real-time access via MATCH Online and API, and batch operations remain available.
 # Merchant URL information may be added and searched.
 # Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
+# Additionally, persistent authentication mechanisms employed in Fraud Monitoring must adhere to Mastercard requirement of explicit cardholder consent prompts and compliance with Mastercard Standards for authentication technology as per SPME 3.11.3.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -12,7 +12,8 @@
 2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.
 3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.
 4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
-5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
-6. Track case progress until the account returns to threshold compliance or is terminated.
+5. Verify that persistent authentication mechanisms incorporate explicit cardholder consent and comply with Mastercard consumer authentication standards, as required by updated Mastercard SPME security rules.
+6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+7. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7 and §11.1.1.
+Source authority: Mastercard SPME §3.7, §3.11.3, and §11.1.1.