program: ATO Detection
- authority: Mastercard SPME §10.6.2.1
+ authority: Mastercard SPME §10.6.2.1, §5.1.1
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
 
# This policy incorporates the updated Mastercard SPME §10.6.2.1 requirements,
# including extended timelines for Terminal Servicer compliance revalidation
# after an Account Data Compromise Event, emphasizing a 90-day PCI DSS
# revalidation period and an added 12-month DESV appendix compliance.
- # It reinforces timely and comprehensive security procedures to mitigate
- # Account Takeover risk in line with Mastercard's updated security standards.
+ # It also integrates the revised procedures from Mastercard SPME §5.1.1
+ # on secure handling and timely return of recovered Cards. This includes
+ # rendering Cards unusable via vertical cutting through the magnetic stripe,
+ # returning Cards to the Issuer within five calendar days alongside the
+ # Interchange Card Recovery Form, and ensuring recovery coordination with
+ # Issuer security contacts. These measures enhance the robustness of
+ # account takeover mitigation through improved card recovery protocols.
+ 
+ # The ATO Detection program continues to emphasize risk scoring and 3DS
+ # challenge implementation aligned with Mastercard standards to prevent fraud.

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements real-time risk scoring on authentication events and enforces a

mandatory 3DS (3-D Secure) challenge for any session where the computed risk score

meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

1. Evaluate each authentication event against the defined signal list in real time.

2. Compute a normalized risk score between 0.0 and 1.0.

3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

4. Log all ATO signals and outcomes in the case management system.

5. Escalate persistent high-risk accounts to the ATO response team for manual review.

6. In the event of an Account Data Compromise (ADC), ensure that any Terminal Servicer

involved revalidates PCI DSS compliance within 90 calendar days after the forensic

investigation concludes, and demonstrate compliance with the PCI DSS Data

Encryption and Software Validation (DESV) appendix within 12 months, consistent

with Mastercard requirements (SPME §10.6.2.1).

7. For recovered cards identified during ATO investigations, ensure they are rendered

unusable by cutting them vertically through the magnetic stripe and returned to the

Issuer within five calendar days with the appropriate Interchange Card Recovery Form,

following procedures updated in Mastercard SPME §5.1.1.1. This timely and secure

handling supports account security and fraud mitigation.

Source authority: Mastercard SPME §6.2, §10.6.2.1.§10.6.2.1, §5.1.1.1.