Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §4.10.4 · May 2023 → Sep 2023

Prolonged Authentication

substantive

The requirement that a successful Prolonged Authentication depends on an initial MFA authentication before cardholder access to stored credentials has been removed, focusing the rules solely on testing consent, authentication factor, and a five-minute open period.

Sources Mastercard SPME · May 2023 · page 56 PDF Mastercard SPME · Sep 2023 · page 52 PDF Fraud Monitoring current
Also in §4.x this release breaking §4.7 Terminal Security Standards substantive §4.1 Personal Identification Numbers (PINs) substantive §4.10 Multi-Factor Authentication Methods for Remote Commerce Token Transactions substantive §4.10.2 Multi-Factor Authentication Method Functionality substantive §4.9 Triple DES Standards
Why these edits? The change removes the requirement that a successful Prolonged Authentication depends on an initial MFA authentication before cardholder access to stored credentials, focusing instead solely on explicit consent, one authentication factor, and a five-minute open period. This adjustment affects the Fraud Monitoring policy which cites security and authentication procedures under section 3.7, closely related to 4.10.4's Authentication provisions.
Mastercard SPME §4.10.4
This section was substantively restructured between versions (33% text overlap). Compare the texts directly below.
Before · May 2023 · page 56

Security Rules and Procedures—Merchant Edition • 7 February 2023

A successful Prolonged Authentication will be dependent upon an initial authentication performed by the Authenticating Entity with the MFA Method; for example, an authentication performed before a Cardholder can access a Stored Credential. For the Authenticating Entity to perform a transaction without the use of the MFA Method, Mastercard requires testing of the proposed functionality for Prolonged Authentication with respect to the following:

  • The Cardholder provides an explicit consent before a Transaction may be effected, for example, by clicking a button on the Authenticating Entity interface.
  • The Authenticating Entity authenticates the Cardholder with one Authentication factor, which may be an existing factor of the MFA Method (in the EEA and United Kingdom, this is in order to comply with the dynamic linking requirement); and
  • The open period ends, which may not exceed five continuous minutes
After · Sep 2023 · page 52

Security Rules and Procedures—Merchant Edition • 1 August 2023

For the Authenticating Entity to perform a transaction without the use of the MFA Method, Mastercard requires testing of the proposed functionality for Prolonged Authentication with respect to the following:

  • The Cardholder provides an explicit consent before a Transaction may be effected, for example, by clicking a button on the Authenticating Entity interface.
  • The Authenticating Entity authenticates the Cardholder with one Authentication factor, which may be an existing factor of the MFA Method (in the EEA and United Kingdom, this is in order to comply with the dynamic linking requirement); and
  • The open period ends, which may not exceed five continuous minutes
Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7, §11.1.1


+ authority: Mastercard SPME §3.7, §11.1.1, §4.10.4


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


 


# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.


# Acquirers may add and search for information on up to five principal owners per Merchant.


# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.


# Retroactive alert processing is supported for data up to 360 days old.


# Acquirers control receipt and detail of inquiry match information.


# Real-time access via MATCH Online and API, and batch operations remain available.


# Merchant URL information may be added and searched.


# Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.


+ 


+ # Updated authentication requirements under SPME §4.10.4 clarify that prolonged authentication no longer requires a prior MFA before cardholder access to stored credentials. Instead, transactions without repeated MFA must follow explicit consent,


+ # authentication with one factor as per MFA standards (not necessarily initial), and a continuous open period no longer than five minutes.


+ # Fraud monitoring processes must incorporate review of these authentication controls to ensure compliance and effective risk mitigation.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

  6. Track case progress until the account returns to threshold compliance or is terminated.

## Authentication Considerations

In alignment with Mastercard SPME updates, specifically section 4.10.4, Halyard Pay acknowledges that Prolonged Authentication no longer requires an initial multifactor authentication before cardholder access to stored credentials. Instead, key controls include explicit cardholder consent before transaction effect, authenticating with a single factor compliant with regional dynamic linking requirements, and limiting the open authentication period to no more than five continuous minutes. These requirements support fraud risk assessments and transaction authentication monitoring under this policy.

Source authority: Mastercard SPME §3.7 §3.7, §4.10.4, and §11.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

  6. Track case progress until the account returns to threshold compliance or is terminated.

## Authentication Considerations

In alignment with Mastercard SPME updates, specifically section 4.10.4, Halyard Pay acknowledges that Prolonged Authentication no longer requires an initial multifactor authentication before cardholder access to stored credentials. Instead, key controls include explicit cardholder consent before transaction effect, authenticating with a single factor compliant with regional dynamic linking requirements, and limiting the open authentication period to no more than five continuous minutes. These requirements support fraud risk assessments and transaction authentication monitoring under this policy.

Source authority: Mastercard SPME §3.7 §3.7, §4.10.4, and §11.1.1.

Source authority: Mastercard SPME §4.10.4.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7, §11.1.1
+authority: Mastercard SPME §3.7, §11.1.1, §4.10.4
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -18,3 +18,7 @@
 # Real-time access via MATCH Online and API, and batch operations remain available.
 # Merchant URL information may be added and searched.
 # Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
+
+# Updated authentication requirements under SPME §4.10.4 clarify that prolonged authentication no longer requires a prior MFA before cardholder access to stored credentials. Instead, transactions without repeated MFA must follow explicit consent,
+# authentication with one factor as per MFA standards (not necessarily initial), and a continuous open period no longer than five minutes.
+# Fraud monitoring processes must incorporate review of these authentication controls to ensure compliance and effective risk mitigation.
--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -15,4 +15,8 @@
 5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
 6. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7 and §11.1.1.
+## Authentication Considerations
+
+In alignment with Mastercard SPME updates, specifically section 4.10.4, Halyard Pay acknowledges that Prolonged Authentication no longer requires an initial multifactor authentication before cardholder access to stored credentials. Instead, key controls include explicit cardholder consent before transaction effect, authenticating with a single factor compliant with regional dynamic linking requirements, and limiting the open authentication period to no more than five continuous minutes. These requirements support fraud risk assessments and transaction authentication monitoring under this policy.
+
+Source authority: Mastercard SPME §3.7, §4.10.4, and §11.1.1.