Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §4.9 · May 2023 → Sep 2023

Triple DES Standards

substantive

The section was extensively rewritten to mandate Triple DES encryption for all newly installed payment entry devices (PEDs) and host systems, require compliance for ATM encrypting PIN pads (EPPs), and transactions routed to Interchange. It also allows Mastercard-approved alternate encryption methods, replacing prior unrelated text on authentication factors.

Sources Mastercard SPME · May 2023 · page 52 PDF Mastercard SPME · Sep 2023 · page 48 PDF Fraud Monitoring current
Also in §4.x this release breaking §4.7 Terminal Security Standards substantive §4.1 Personal Identification Numbers (PINs) substantive §4.10 Multi-Factor Authentication Methods for Remote Commerce Token Transactions substantive §4.10.2 Multi-Factor Authentication Method Functionality substantive §4.10.4 Prolonged Authentication
Why these edits? The updated rule mandates the use of Triple DES encryption for all newly installed payment entry devices and host systems, which impacts the Fraud Monitoring policy's obligation to ensure transaction security and encryption standards are met.
Mastercard SPME §4.9
This section was substantively restructured between versions (1% text overlap). Compare the texts directly below.
Before · May 2023 · page 52

Security Rules and Procedures—Merchant Edition • 7 February 2023

  • Possession factor, defined as "something only the user possesses" such as personal computers, tablets, mobile phones, IoT devices (such as connected cars) and security tokens.
  • Knowledge factor, defined as "something only the user knows" such as PINs or passwords, which are either: – Fully managed by the Authenticating Entity, such as a password or PIN created and verified by the Authenticating Entity. – Shared with the operating system on the Cardholder’s consumer device, such as a password or PIN defined by the Cardholder for consumer device access and which can be used across multiple applications; it is created and verified locally by the consumer device’s operating system (for example, Android, iOS, MAC OS, Windows)
  • Inherence factor, defined as "something the user is"; it includes several categories of factors that can be used for the purpose of uniquely identifying a person: – Physical biometrics like fingerprint, physiological or facial recognition. – Behavioral biometrics that relate to behavioral processes created for example by the human body, the way that Cardholders tap on, type, swipe or hold a device. – Where allowed under applicable legislation, behavioral-based inherence information generated from multiple data points that include elements identifying, for example, the Cardholder’s location, spending habits and Transaction history.
After · Sep 2023 · page 48

Triple Data Encryption Standard (DES), minimum double key length (hereafter referred to as Triple DES), must be implemented as follows:

  • All newly installed PEDs, including replacement and refurbished PEDs that are part of POS Terminals, must be Triple DES capable. This requirement applies to POS Terminals owned by Customers and non-Customers.
  • All Customer and processor host systems must support Triple DES.
  • It is strongly recommended that all PEDs that are part of POS Terminals be Triple DES compliant and chip-capable.
  • All EPPs that are part of ATM Terminals must be Triple DES compliant.
  • All Transactions routed to the Interchange System must be Triple DES compliant. Mastercard recognizes that Customers may elect to use other public key encryption methods between their POS Terminals or ATMs and their host(s). In such instances, Mastercard must approve the alternate method chosen in advance of its implementation and use. Terminal, PIN, and MFA Method Security Standards
Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7, §11.1.1


+ authority: Mastercard SPME §3.7, §11.1.1, §4.9


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


 


# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.


# Acquirers may add and search for information on up to five principal owners per Merchant.


# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.


# Retroactive alert processing is supported for data up to 360 days old.


# Acquirers control receipt and detail of inquiry match information.


# Real-time access via MATCH Online and API, and batch operations remain available.


# Merchant URL information may be added and searched.


# Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.


+ #


+ # To align with the updated Mastercard SPME §4.9 triple DES encryption mandate, fraud monitoring processes must ensure that all payment entry and processing devices involved in transaction capture and authorization are compliant with encryption standards to maintain transaction security and data integrity.


+ # This includes verifying that all newly installed PEDs and host systems support Triple DES encryption, and that alerts or escalations consider encryption non-compliance as part of risk evaluation.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

  6. Track case progress until the account returns to threshold compliance or is terminated.

7. Ensure that all payment devices and host systems involved in transaction processing support Triple DES encryption as required by Mastercard's updated security rules, to maintain data confidentiality and integrity throughout the transaction lifecycle.

Source authority: Mastercard SPME §3.7 §3.7, §4.9, and §11.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

  6. Track case progress until the account returns to threshold compliance or is terminated.

7. Ensure that all payment devices and host systems involved in transaction processing support Triple DES encryption as required by Mastercard's updated security rules, to maintain data confidentiality and integrity throughout the transaction lifecycle.

Source authority: Mastercard SPME §3.7 §3.7, §4.9, and §11.1.1.

Source authority: Mastercard SPME §4.9.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7, §11.1.1
+authority: Mastercard SPME §3.7, §11.1.1, §4.9
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -18,3 +18,6 @@
 # Real-time access via MATCH Online and API, and batch operations remain available.
 # Merchant URL information may be added and searched.
 # Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
+#
+# To align with the updated Mastercard SPME §4.9 triple DES encryption mandate, fraud monitoring processes must ensure that all payment entry and processing devices involved in transaction capture and authorization are compliant with encryption standards to maintain transaction security and data integrity.
+# This includes verifying that all newly installed PEDs and host systems support Triple DES encryption, and that alerts or escalations consider encryption non-compliance as part of risk evaluation.

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -15,4 +15,6 @@
 5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
 6. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7 and §11.1.1.
+7. Ensure that all payment devices and host systems involved in transaction processing support Triple DES encryption as required by Mastercard's updated security rules, to maintain data confidentiality and integrity throughout the transaction lifecycle.
+
+Source authority: Mastercard SPME §3.7, §4.9, and §11.1.1.