program: Fraud Monitoring
- authority: Mastercard SPME §3.7, §11.1.1
+ authority: Mastercard SPME §3.7, §11.1.1, §8.3.4
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
  - escalate_to_human_review
  - notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
 
- # MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.
- # Acquirers may add and search for information on up to five principal owners per Merchant.
- # Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.
- # Retroactive alert processing is supported for data up to 360 days old.
- # Acquirers control receipt and detail of inquiry match information.
- # Real-time access via MATCH Online and API, and batch operations remain available.
- # Merchant URL information may be added and searched.
- # Crucially, after obtaining MATCH inquiry results, Acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
+ # MATCH fraud detection features focus on principal owners only, consistent with SPME §11.1.1.
+ # Acquirers may manage information on up to five principal owners per Merchant.
+ # Multiple data fields support accurate matching; error notifications assist in reducing delays.
+ # Retroactive alerts can be triggered for data up to 360 days old.
+ # Acquirers control their receipt and detail of inquiry match info.
+ # Real-time and batch MATCH operations remain supported.
+ # Merchant URL details can be added and searched.
+ # After MATCH inquiries, acquirers must evaluate additional investigation or risk mitigation in accordance with updated Mastercard requirements.
+ # As per Mastercard SPME §8.3.4, after a Merchant’s ECM or HECM status persists for six months cumulatively, Mastercard may advise Acquirers on an action plan to reduce Merchant risk or require a Franchise Management Program Customer Risk Review at the Acquirer’s expense.
+ # Fraud monitoring programs should incorporate this escalation pathway and coordinate with Acquirers accordingly.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

4. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

5. Upon a merchant reaching ECM or HECM status for six months, anticipate possible advisory action plans and Franchise Management Program Customer Risk Reviews mandated by Mastercard, and cooperate accordingly.

6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

6. 7. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7 §3.7, §8.3.4, and §11.1.1.