program: ATO Detection
- authority: Mastercard SPME §10.6.2.1
+ authority: Mastercard SPME §8.6.2
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
 
- # This policy incorporates the updated Mastercard SPME §10.6.2.1 requirements,
- # including extended timelines for Terminal Servicer compliance revalidation
- # after an Account Data Compromise Event, emphasizing a 90-day PCI DSS
- # revalidation period and an added 12-month DESV appendix compliance.
- # It reinforces timely and comprehensive security procedures to mitigate
- # Account Takeover risk in line with Mastercard's updated security standards.
+ # This policy updates reflect Mastercard's enhanced investigation criteria under SPME §8.6.2,
+ # incorporating issuer obligations to follow up with Cardholders within 10 calendar days
+ # after notification of alleged coerced Transactions, requesting a police report or a
+ # detailed explanation if no report is available. This strengthens documentation requirements
+ # and improves the rigor of Account Takeover detection responses by ensuring timely
+ # issuer-to-Cardholder communication for coercion claims.

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to

a cardholder's account and initiates transactions without the cardholder's consent.

Halyard Pay implements real-time risk scoring on authentication events and enforces a

mandatory 3DS (3-D Secure) challenge for any session where the computed risk score

meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies

inconsistent with a cardholder's established pattern, changes to device fingerprint,

transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

1. Evaluate each authentication event against the defined signal list in real time.

2. Compute a normalized risk score between 0.0 and 1.0.

3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before

authorizing the transaction.

4. Log all ATO signals and outcomes in the case management system.

5. Escalate persistent high-risk accounts to the ATO response team for manual review.

6. In the event of an Account Data Compromise (ADC), ensure that any Terminal Servicer

involved revalidates PCI DSS compliance within 90 calendar days after the forensic

investigation concludes, and demonstrate compliance with the PCI DSS Data

Encryption and Software Validation (DESV) appendix within 12 months, consistent

with Mastercard requirements (SPME §10.6.2.1).

7. For cases involving alleged coercion, follow updated Mastercard protocols requiring

issuers notified of the potential coerced transactions at a merchant to contact their

cardholders within 10 calendar days to obtain a police report or, if unavailable,

a cardholder explanation for the absence of police documentation, to support

investigation and validation efforts (SPME §8.6.2).

Source authority: Mastercard SPME §6.2, §8.6.2, §10.6.2.1.