Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §8.6 · Sep 2023 → Feb 2024

Coercion Program

substantive

The Coercion Program description was fully replaced with detailed procedural requirements, including evidence submission such as police reports and fraud reporting codes, and a process for notifying issuers to collect claims and affidavits within specified timeframes. This adds specific documentation and notification steps for handling coercion claims involving cardholders.

Sources Mastercard SPME · Sep 2023 · page 84 PDF Mastercard SPME · Feb 2024 · page 83 PDF Fraud Monitoring current
Also in §8.x this release breaking §8.6.5 Chargeback Responsibility substantive §8.4 Questionable Merchant Audit Program (QMAP) substantive §8.4.2 Mastercard Commencement of an Investigation substantive §8.4.3 of this manual, or substantive §8.4.6 Mastercard Determination substantive §8.4.8 Fraud Recovery substantive §8.6.1 Issuer Submissions substantive §8.6.2 Investigation Process substantive §8.6.7 Franchise Management Program (FMP) Questionnaire-based Review substantive §8.7.1 Definitions substantive §8.7.3 Mastercard Notification to Acquirers substantive §8.8 Business Risk Assessment and Mitigation (BRAM) Program substantive §8.8.1 BRAM Investigation Process substantive §8.8.2 Acquirer Response Requirements substantive §8.8.4 Noncompliance Assessment Mitigation substantive §8.9 Merchant Monitoring Program (MMP) substantive §8.9.1 MMP Participation Requirements
Why these edits? The updated Coercion Program requires specific documentation such as police reports and fraud reporting codes, along with issuer notification procedures to collect claims and affidavits, expanding obligations related to fraud monitoring and claim validation.
Mastercard SPME §8.6
This section was substantively restructured between versions (3% text overlap). Compare the texts directly below.
Before · Sep 2023 · page 84

Mastercard developed the Coercion Program to help address Cardholder claims of being coerced into performing a Transaction. For the purpose of this program, coercion is defined as Cardholder completion of a Transaction due to threatened or actual physical harm to the Cardholder (or the Cardholder’s immediate family member) or the threatened or actual unlawful taking of property from the Cardholder (or the Cardholder’s immediate family member). Mastercard Fraud Control Programs

After · Feb 2024 · page 83

Security Rules and Procedures—Merchant Edition • 6 February 2024

  • At least one claim of coercion includes a copy of a police report filed by the Cardholder.
  • The Transactions resulting from the alleged coercion were reported to the Fraud and Loss Database using fraud type code 00 (Lost Fraud) or 01 (Stolen Fraud). At Mastercard’s sole discretion, a Transaction reported with a fraud reason code other than 00 or 01 may be included in the investigation. Additionally, Mastercard will notify those Issuers whose Cardholders have performed a Transaction at the Merchant within the 120 calendar day (or longer) period of the alleged coerced event and who have not already submitted a Cardholder’s claim of coercion that each Issuer has 10 calendar days from the initial notification date to contact the Cardholder, if necessary, and provide:
  • A police report (if available) When a police report is not provided, the Cardholder’s description must address why a police report was not provided. The Cardholder description must include whether an attempt was made to file a police report and, if not, why a police report was not filed.
  • The Cardholder’s detailed description of the alleged coercive event.
  • The Coercion Claim Affidavit Form, completed by the Issuer on the Cardholder’s behalf with the Cardholder’s consent, thereby authorizing Mastercard to contact law enforcement regarding the alleged coercive event. The Coercion Claim Affidavit form is published on Mastercard Connect > Support > Forms.
Halyard Pay · 2 files
program: Fraud Monitoring


authority: Mastercard SPME §3.7, §8.6.6, §11.1.1


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


 


# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.


# Acquirers may add and search for information on up to five principal owners per Merchant.


# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.


# Retroactive alert processing is supported for data up to 360 days old.


# Acquirers control receipt and detail of inquiry match information.


# Real-time access via MATCH Online and API, and batch operations remain available.


# Merchant URL information may be added and searched.


# After obtaining MATCH inquiry results, acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.


#


# New requirements under SPME §8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.


# Merchants subject to a subsequent claim of coercion within 12 months will be added with reason code 00 (Questionable Acquirer/Under Investigation).


# If the claim is confirmed to meet Coercion Program criteria, the MATCH record will be updated to reason code 24.


# If not confirmed, the MATCH record will be deleted.


# These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.


+ 


+ # Enhanced documentation and procedural requirements are mandated for processing coercion claims under SPME §8.6.6.


+ # Claims must be supported by a police report or a written explanation why none is available, and transactions must be reported with fraud codes 00 or 01 or subject to Mastercard discretion.


+ # Issuers must be notified of cardholders performing transactions at implicated Merchants within a 120-day window and have 10 calendar days to secure detailed cardholder information, including the Coercion Claim Affidavit Form.


+ # These measures expand issuer responsibilities for fraud claim validation and facilitate law enforcement engagement.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: claims: merchants may be added flagged with reason code 24 for illegal transactions upon meeting coercion criteria, or with when coercion is suspected, or code 00 if a subsequent coercion claim arises within 12 months; maintain or remove these records must be updated or removed based on confirmation of these claims. validation.

  5. For coercion claims reported through MATCH, require that claims are supported by documented police reports or detailed descriptions explaining the absence thereof, as well as appropriate affidavit forms per Mastercard’s updated procedures.

6. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

6. 7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

7. 8. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7, §8.6.6, §8.6 (updated 2024), and §11.1.1.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: claims: merchants may be added flagged with reason code 24 for illegal transactions upon meeting coercion criteria, or with when coercion is suspected, or code 00 if a subsequent coercion claim arises within 12 months; maintain or remove these records must be updated or removed based on confirmation of these claims. validation.

  5. For coercion claims reported through MATCH, require that claims are supported by documented police reports or detailed descriptions explaining the absence thereof, as well as appropriate affidavit forms per Mastercard’s updated procedures.

6. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

6. 7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

7. 8. Track case progress until the account returns to threshold compliance or is terminated.

Source authority: Mastercard SPME §3.7, §8.6.6, §8.6 (updated 2024), and §11.1.1.

Source authority: Mastercard SPME §8.6.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -23,4 +23,9 @@
 # Merchants subject to a subsequent claim of coercion within 12 months will be added with reason code 00 (Questionable Acquirer/Under Investigation).
 # If the claim is confirmed to meet Coercion Program criteria, the MATCH record will be updated to reason code 24.
 # If not confirmed, the MATCH record will be deleted.
-# These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.+# These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.
+
+# Enhanced documentation and procedural requirements are mandated for processing coercion claims under SPME §8.6.6.
+# Claims must be supported by a police report or a written explanation why none is available, and transactions must be reported with fraud codes 00 or 01 or subject to Mastercard discretion.
+# Issuers must be notified of cardholders performing transactions at implicated Merchants within a 120-day window and have 10 calendar days to secure detailed cardholder information, including the Coercion Claim Affidavit Form.
+# These measures expand issuer responsibilities for fraud claim validation and facilitate law enforcement engagement.

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -11,9 +11,10 @@
 1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.
 2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.
 3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.
-4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.
-5. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
-6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
-7. Track case progress until the account returns to threshold compliance or is terminated.
+4. Maintain awareness of Mastercard's MATCH reason codes related to coercion claims: merchants may be flagged with code 24 for illegal transactions when coercion is suspected, or code 00 if a subsequent coercion claim arises within 12 months; maintain or remove these records based on validation.
+5. For coercion claims reported through MATCH, require that claims are supported by documented police reports or detailed descriptions explaining the absence thereof, as well as appropriate affidavit forms per Mastercard’s updated procedures.
+6. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
+7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+8. Track case progress until the account returns to threshold compliance or is terminated.
 
-Source authority: Mastercard SPME §3.7, §8.6.6, and §11.1.1.
+Source authority: Mastercard SPME §3.7, §8.6 (updated 2024), and §11.1.1.