program: ATO Detection
- authority: Mastercard SPME §10.6.2.1
+ authority: Mastercard SPME 10.6.2.1 and 6.2.2.1
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
 
- # This policy incorporates the updated Mastercard SPME §10.6.2.1 requirements,
- # including extended timelines for Terminal Servicer compliance revalidation
- # after an Account Data Compromise Event, emphasizing a 90-day PCI DSS
- # revalidation period and an added 12-month DESV appendix compliance.
- # It reinforces timely and comprehensive security procedures to mitigate
- # Account Takeover risk in line with Mastercard's updated security standards.
+ # This policy incorporates updated Mastercard SPME 10.6.2.1 requirements,
+ # including timelines for Terminal Servicer compliance revalidation,
+ # and the reinforced fraud loss control program requirements in 6.2.2.
+ # Specifically, for Acquirers in the Europe Region (excluding certain countries),
+ # the policy integrates the new mandate to enforce strong authentication via
+ # EMV 3DS challenge or equivalent SCA methods when storing credentials or at
+ # the first transaction after Card-add, ensuring enhanced detection and
+ # prevention of Account Takeover events.
+ #
+ # Fraud detection staff must analyze alerts and reports within 24 hours,
+ # with mitigation initiated within 72 hours of transaction occurrence, aligning
+ # with Mastercard's expectation for timely response.
+ 

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements real-time risk scoring on authentication events and enforces a

mandatory 3DS (3-D Secure) challenge for any session where the computed risk score

meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

1. Evaluate each authentication event against the defined signal list in real time.

2. Compute a normalized risk score between 0.0 and 1.0.

3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

4. For Acquirers operating in Mastercard's Europe Region (excluding specified countries), ensure compliance with the enhanced authentication requirement: at Credential-on-file storage or wallet/Tokenization, or at latest the first post Card-add Transaction, enforce EMV 3DS authentication with challenge (challenge IND = 04, RREQ = Y) or an equivalent Strong Customer Authentication (SCA) method with issuer step-up.

5. Log all ATO signals and outcomes in the case management system.

5. 6. Escalate persistent high-risk accounts to the ATO response team for manual review.

6. 7. In the event of an Account Data Compromise (ADC), ensure that any Terminal Servicer

involved revalidates PCI DSS compliance within 90 calendar days after the forensic

investigation concludes, and demonstrate compliance with the PCI DSS Data

Encryption and Software Validation (DESV) appendix within 12 months, consistent

with Mastercard requirements (SPME §10.6.2.1).

Source authority: Mastercard SPME §6.2, §6.2.2.1, §10.6.2.1.