Card retention must occur only at the Issuer’s command. Cards captured because of ATM Terminal malfunction or Cardholder error, over which the ATM Terminal owner has no control, are the only allowable exceptions. If the ATM Acquirer cannot determine within two business days if a Card was captured because of a machine malfunction, Cardholder error, or a command sent by the Issuer, the Card will be deemed to be a Card captured on command of the Issuer. An ATM Terminal Acquirer that as an Issuer sends Card capture commands must honor the commands sent by other Issuers at all of its ATMs that are capable of Card capture. In the Europe Region, the Acquirer of any ATM Terminal capable of Card capture must honor the Card capture commands sent by any Issuer. Completion messages must indicate, to the best knowledge of the Acquirer, the action taken by the ATM for each Card capture request. Card Recovery and Return Standards 5.1.1.3 Liability for Loss, Costs, and Damages Security Rules and Procedures—Merchant Edition • 1 August 2023

5.1.2.1 Handling ATM-Retained Cards An ATM Terminal Acquirer must handle retained Cards in accordance with the following requirements:

1. Log all retained Mastercard® Cards under dual control immediately upon removal from the ATM. With respect to retained Maestro® and Cirrus® Cards, it is the responsibility of the Acquirer to establish appropriate procedures for documenting a Card capture.
2. Destroy retained Cards by cutting them in half vertically through the magnetic stripe, if the Card is captured on command of the Issuer or if an Acquirer’s procedures do not include returning retained Cards to Cardholders. A Maestro Card issued outside of the Europe Region and captured by an ATM Terminal located in the Europe Region must be destroyed and discarded. When a captured card appears to be fraudulent (for example, a plain white plastic or cardboard card), the Acquirer may (at its option) retain, preserve, and release such card to appropriate law enforcement authorities. 5.1.2.2 Returning ATM-Retained Cards to Cardholders Cards retained at the request of an Issuer must never be returned to the Cardholder without the permission of the Issuer. However, Cards erroneously retained by the Acquirer because of a machine malfunction, system failure, or Cardholder error may be held at the ATM location, in a secure place, for two business days following capture and released to the Cardholder subsequent to all of the following:
3. The Acquirer checks the Electronic Warning Bulletin file or applicable regional Warning Notice (required for Mastercard Cards only).
4. The Cardholder presents reasonable identification (for example, a current driver’s license, passport, or similar identification with a picture or descriptive data and a signature that is comparable to the signature on the captured Card, if applicable).
5. The Cardholder signs a disposition log or receipt, or the Acquirer otherwise maintains a record of the action taken. The Acquirer then must notify the Issuer and explain that the Card was retained, the circumstances of the retention, and that the Card was returned to the Cardholder. If the Cardholder does not return to claim the Card before the end of the second business day following Card capture, the Card's magnetic stripe must be destroyed. An Acquirer will not incur liability for fraudulent or unauthorized Transactions initiated with a Card that such Acquirer has returned to a Cardholder following the Card's capture at an ATM Terminal, provided that the Acquirer complied with the requirements described in this section. 5.1.2.3 Fees for ATM Card Retention and Return The Acquirer must not charge the Issuer any fee for the ATM retention or return of a Card. Card Recovery and Return Standards 5.1.2.1 Handling ATM-Retained Cards Security Rules and Procedures—Merchant Edition • 1 August 2023