Mastercard SPME §8.6.2 · Sep 2023 → Feb 2024

Investigation Process

substantive

The updated section removes requirements about the police report submissions and the reporting of Transactions with specific fraud type codes related to alleged coercion claims, simplifying the criteria for Mastercard's investigation initiation.

Sources Mastercard SPME · Sep 2023 · page 85 PDF Mastercard SPME · Feb 2024 · page 83 PDF Fraud Monitoring current

Also in §8.x this release breaking §8.6.5 Chargeback Responsibility substantive §8.4 Questionable Merchant Audit Program (QMAP) substantive §8.4.2 Mastercard Commencement of an Investigation substantive §8.4.3 of this manual, or substantive §8.4.6 Mastercard Determination substantive §8.4.8 Fraud Recovery substantive §8.6 Coercion Program substantive §8.6.1 Issuer Submissions substantive §8.6.7 Franchise Management Program (FMP) Questionnaire-based Review substantive §8.7.1 Definitions substantive §8.7.3 Mastercard Notification to Acquirers substantive §8.8 Business Risk Assessment and Mitigation (BRAM) Program substantive §8.8.1 BRAM Investigation Process substantive §8.8.2 Acquirer Response Requirements substantive §8.8.4 Noncompliance Assessment Mitigation substantive §8.9 Merchant Monitoring Program (MMP) substantive §8.9.1 MMP Participation Requirements

Why these edits? The removal of requirements related to police report submissions and specific fraud type codes for alleged coercion claims impacts how fraud monitoring of coercion-based fraud is managed and documented.

Mastercard SPME §8.6.2

Mastercard will investigate a claim of alleged coercion when the following criteria are met: • Within 120 calendar days from an alleged coercive event, Mastercard receives from two or more different issuers separate claims of alleged coerced Transactions performed by two or more unrelated Cardholders at the same Merchant location. The 120 calendar day period is calculated as 60 calendar days prior to and 60 calendar days after the date of the first alleged coerced Transaction. At Mastercard’s sole discretion, the 120 calendar day period may be expanded. • ¶ At least one claim of coercion includes a copy of a police report filed by the Cardholder ¶ • ¶ The Transactions resulting from the alleged coercion were reported to the Fraud and Loss ¶ Database using fraud type code 00 (Lost Fraud) or 01 (Stolen Fraud). At Mastercard’s sole ¶ discretion, a Transaction reported with a fraud reason code other than 00 or 01 may be ¶ included in the investigation. ¶ Additionally, Mastercard will notify those Issuers whose Cardholders have performed a ¶ Transaction at the Merchant within the 120 calendar day (or longer) period of the alleged ¶ coerced event and who have not already submitted a Cardholder’s claim of coercion that each ¶ Issuer has 10 calendar days from the initial notification date to contact the Cardholder, if ¶ necessary, and provide: ¶ • ¶ A police report (if available) When a police report is not provided, the Cardholder’s ¶ description must address why a police report was not provided. The Cardholder description ¶ Mastercard Fraud Control Programs

Halyard Pay · 2 files

Fraud Monitoring · rules.yaml

program: Fraud Monitoring
- authority: Mastercard SPME §3.7, §8.6.6, §11.1.1
+ authority: Mastercard SPME §3.7, §8.6.6, §8.6.2, §11.1.1
fraud_to_sales_ratio_threshold: 0.015
min_count_per_month: 100
monitoring_cadence: monthly
escalation_actions:
- escalate_to_human_review
- notify_acquirer
lookback_period_months: 1
remediation_review_interval_days: 30
agent_owner: fraud_ops_agent
- # MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.
- # Acquirers may add and search for information on up to five principal owners per Merchant.
- # Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.
- # Retroactive alert processing is supported for data up to 360 days old.
- # Acquirers control receipt and detail of inquiry match information.
- # Real-time access via MATCH Online and API, and batch operations remain available.
- # Merchant URL information may be added and searched.
- # After obtaining MATCH inquiry results, acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
- #
- # New requirements under SPME §8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.
- # Merchants subject to a subsequent claim of coercion within 12 months will be added with reason code 00 (Questionable Acquirer/Under Investigation).
- # If the claim is confirmed to meet Coercion Program criteria, the MATCH record will be updated to reason code 24.
- # If not confirmed, the MATCH record will be deleted.
- # These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.
+ # MATCH fraud detection features focus exclusively on principal owners, excluding associate owners and Service Provider name reporting per SPME §11.1.1.
+ # Acquirers may manage up to five principal owners per merchant and utilize multiple data fields for accurate matching.
+ # Mechanisms exist for editing and correcting MATCH data to minimize delays, with retroactive alert processing supported up to 360 days.
+ # Acquirers retain control over the visibility and detail of inquiry matches and have access to real-time and batch MATCH operations.
+ # Merchant URL data may be integrated and searched as part of fraud monitoring.
+ # Post-MATCH inquiry, acquirers are required to evaluate results and determine appropriate investigative or risk mitigation follow-up actions as stipulated in the updated SPME.
+ #
+ # SPME §8.6.6 introduces requirements for adding merchants to MATCH with reason code 24 (Illegal Transactions) when meeting Coercion Program criteria;
+ # subsequent coercion claims within 12 months trigger addition with reason code 00 and conditional updating or removal based on investigation outcomes.
+ # These steps are designed to enhance fraud monitoring by capturing coercion-related transaction risks effectively.
+ #
+ # The updated SPME §8.6.2 modifies the investigation criteria for alleged coercion claims, removing the prior mandates for police report submissions and specific fraud type codes;
+ # Mastercard now investigates if multiple issuers report unrelated coerced transactions at the same merchant within a defined timeframe, with discretion to expand the investigatory period.
+ # This wider investigative approach supports improved detection and management of coercion claims within fraud monitoring processes.

Fraud Monitoring · policy.md

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.
Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.
Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.
Recognize that Mastercard's investigation criteria for coercion claims have changed; specific requirements for police reports and fraud type codes no longer apply, indicating a shift toward broader claim acceptance as per Mastercard SPME §8.6.2.

6. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

6. 7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

7. 8. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7, §8.6.2, §8.6.6, and §11.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

Compute the merchant's rolling fraud-to-sales ratio each calendar month.
If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.
Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.
Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.
Recognize that Mastercard's investigation criteria for coercion claims have changed; specific requirements for police reports and fraud type codes no longer apply, indicating a shift toward broader claim acceptance as per Mastercard SPME §8.6.2.

6. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

6. 7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

7. 8. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7, §8.6.2, §8.6.6, and §11.1.1.

Source authority: Mastercard SPME §8.6.2.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7, §8.6.6, §11.1.1
+authority: Mastercard SPME §3.7, §8.6.6, §8.6.2, §11.1.1
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -10,17 +10,17 @@
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
 
-# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.
-# Acquirers may add and search for information on up to five principal owners per Merchant.
-# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.
-# Retroactive alert processing is supported for data up to 360 days old.
-# Acquirers control receipt and detail of inquiry match information.
-# Real-time access via MATCH Online and API, and batch operations remain available.
-# Merchant URL information may be added and searched.
-# After obtaining MATCH inquiry results, acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
-#
-# New requirements under SPME §8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.
-# Merchants subject to a subsequent claim of coercion within 12 months will be added with reason code 00 (Questionable Acquirer/Under Investigation).
-# If the claim is confirmed to meet Coercion Program criteria, the MATCH record will be updated to reason code 24.
-# If not confirmed, the MATCH record will be deleted.
-# These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.+# MATCH fraud detection features focus exclusively on principal owners, excluding associate owners and Service Provider name reporting per SPME §11.1.1.
+# Acquirers may manage up to five principal owners per merchant and utilize multiple data fields for accurate matching.
+# Mechanisms exist for editing and correcting MATCH data to minimize delays, with retroactive alert processing supported up to 360 days.
+# Acquirers retain control over the visibility and detail of inquiry matches and have access to real-time and batch MATCH operations.
+# Merchant URL data may be integrated and searched as part of fraud monitoring.
+# Post-MATCH inquiry, acquirers are required to evaluate results and determine appropriate investigative or risk mitigation follow-up actions as stipulated in the updated SPME.
+# 
+# SPME §8.6.6 introduces requirements for adding merchants to MATCH with reason code 24 (Illegal Transactions) when meeting Coercion Program criteria;
+# subsequent coercion claims within 12 months trigger addition with reason code 00 and conditional updating or removal based on investigation outcomes.
+# These steps are designed to enhance fraud monitoring by capturing coercion-related transaction risks effectively.
+# 
+# The updated SPME §8.6.2 modifies the investigation criteria for alleged coercion claims, removing the prior mandates for police report submissions and specific fraud type codes;
+# Mastercard now investigates if multiple issuers report unrelated coerced transactions at the same merchant within a defined timeframe, with discretion to expand the investigatory period.
+# This wider investigative approach supports improved detection and management of coercion claims within fraud monitoring processes.

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -12,8 +12,9 @@
 2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.
 3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.
 4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.
-5. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
-6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
-7. Track case progress until the account returns to threshold compliance or is terminated.
+5. Recognize that Mastercard's investigation criteria for coercion claims have changed; specific requirements for police reports and fraud type codes no longer apply, indicating a shift toward broader claim acceptance as per Mastercard SPME §8.6.2.
+6. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
+7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+8. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7, §8.6.6, and §11.1.1.
+Source authority: Mastercard SPME §3.7, §8.6.2, §8.6.6, and §11.1.1.