Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §7.1.3 · May 2023 → Sep 2023

Assessments for Noncompliance with Screening Procedures

substantive

The revised section adds a recommendation for Acquirers in specific European countries to ensure wallets detect fraud signals, such as many top-ups or cryptocurrency purchases, and limit the number of cards that can top-up an account. The existing requirements for re-performing onboarding screening procedures remain unchanged.

Sources Mastercard SPME · May 2023 · page 77 PDF Mastercard SPME · Sep 2023 · page 72 PDF Fraud Monitoring current
Also in §7.x this release substantive §7.2 Ongoing Monitoring
Why these edits? The section adds a recommendation for Acquirers in specific European countries to ensure wallets detect fraud signals such as many top-ups or cryptocurrency purchases and limit the number of cards that can top-up an account, expanding fraud monitoring obligations beyond existing controls.
Mastercard SPME §7.1.3
Security Rules and Procedures—Merchant Edition • 7 February 1 August 2023 monitoring includes, but is not limited to, the Acquirer fraud loss controls relating ¶ to deposit (including credits) and authorization activity described in section 6.2.2. ¶ With respect to an electronic commerce (e-commerce) Merchant, the Acquirer ¶ regularly, as reasonably appropriate in light of all circumstances, must review and ¶ monitor the Merchant’s website(s) and business activities to confirm and to ¶ reconfirm regularly that any activity related to or using a Mark is conducted in a ¶ legal and ethical manner and in full compliance with the Standards. The Acquirer ¶ must ensure that a Payment Facilitator conducts such monitoring with respect to ¶ each of its Sponsored Merchant’s website(s). ¶ As a best practice, To mitigate social engineering fraud, Mastercard recommends that Acquirers use a Merchant ¶ monitoring solution in the Europe Region (excluding Armenia, Azerbaijan, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Moldova, Tajikistan, Turkey, Turkmenistan, Ukraine, and Uzbekistan) ensure that wallets detect typical fraud signals on wallet accounts, such as a high number of wallet top-ups or cryptocurrency purchases followed by rapid transfers to review their e-commerce Merchants’ and Sponsored ¶ Merchants’ activity other digital wallets or cryptocurrency accounts, or by other spend with such wallets. It is recommended that Acquirers ensure that wallets apply strict criteria for blocking accounts and limit, for example, to avoid processing illegal or brand-damaging Transactions. a maximum of three, the number of Cards that can top-up an account. An Acquirer must re-perform the onboarding screening procedures set forth in section 7.1.1 of this manual, in the following situations: • Changes in ownership of a Merchant, Payment Facilitator, or ATM owner, whether confirmed or suspected • Changes in country location of a Merchant, Payment Facilitator, or ATM owner • Changes in Merchant or Payment Facilitator activities, declared by the Merchant, Payment Facilitator or detected by the Acquirer • In case of suspected or confirmed violation of the Questionable Merchant Activity Program (QMAP), Business Risk Assessment Management (BRAM) Program, Excessive Fraud Merchant (EFM) and Excessive Chargeback Merchant (ECM) Program. An Acquirer is recommended to re-perform, on a yearly basis, Merchant screening controls for Merchants with activities in the categories listed in section 9.1 of this manual.
Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7, §11.1.1


+ authority: Mastercard SPME §3.7, §7.1.3, §11.1.1


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


 


# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.


# Acquirers may add and search for information on up to five principal owners per Merchant.


# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.


# Retroactive alert processing is supported for data up to 360 days old.


# Acquirers control receipt and detail of inquiry match information.


# Real-time access via MATCH Online and API, and batch operations remain available.


# Merchant URL information may be added and searched.


# Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.


+ #


+ # Additionally, for Acquirers operating in the specified European countries, monitoring must include detection of social engineering fraud signals related to wallet accounts, such as frequent top-ups, cryptocurrency purchases, and rapid fund transfers.


+ # Wallet accounts should have strict blocking criteria, including limiting the number of cards able to top-up an account to a maximum of three, according to Mastercard SPME §7.1.3.


+

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

  6. Track case progress until the account returns to threshold compliance or is terminated.

7. For merchants located in the European region (excluding specified countries as outlined in Mastercard SPME §7.1.3), monitor wallet-related activity for fraud signals such as multiple wallet top-ups or cryptocurrency purchases followed by rapid transfers or other spending behaviors; impose strict limits on the number of cards permitted to top up a wallet account, with three as a recommended maximum per account.

Source authority: Mastercard SPME §3.7 §3.7, §7.1.3, and §11.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

  5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

  6. Track case progress until the account returns to threshold compliance or is terminated.

7. For merchants located in the European region (excluding specified countries as outlined in Mastercard SPME §7.1.3), monitor wallet-related activity for fraud signals such as multiple wallet top-ups or cryptocurrency purchases followed by rapid transfers or other spending behaviors; impose strict limits on the number of cards permitted to top up a wallet account, with three as a recommended maximum per account.

Source authority: Mastercard SPME §3.7 §3.7, §7.1.3, and §11.1.1.

Source authority: Mastercard SPME §7.1.3.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7, §11.1.1
+authority: Mastercard SPME §3.7, §7.1.3, §11.1.1
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -18,3 +18,7 @@
 # Real-time access via MATCH Online and API, and batch operations remain available.
 # Merchant URL information may be added and searched.
 # Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
+#
+# Additionally, for Acquirers operating in the specified European countries, monitoring must include detection of social engineering fraud signals related to wallet accounts, such as frequent top-ups, cryptocurrency purchases, and rapid fund transfers.
+# Wallet accounts should have strict blocking criteria, including limiting the number of cards able to top-up an account to a maximum of three, according to Mastercard SPME §7.1.3.
+

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -14,5 +14,6 @@
 4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
 5. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
 6. Track case progress until the account returns to threshold compliance or is terminated.
+7. For merchants located in the European region (excluding specified countries as outlined in Mastercard SPME §7.1.3), monitor wallet-related activity for fraud signals such as multiple wallet top-ups or cryptocurrency purchases followed by rapid transfers or other spending behaviors; impose strict limits on the number of cards permitted to top up a wallet account, with three as a recommended maximum per account.
 
-Source authority: Mastercard SPME §3.7 and §11.1.1.
+Source authority: Mastercard SPME §3.7, §7.1.3, and §11.1.1.