Mastercard SPME §10.3 · Feb 2024 → Sep 2024
Responsibilities in Connection with ADC Events and Potential ADC Events
The updated section mandates Customers and Agents to notify Mastercard within 24 hours of any ADC Event or Potential ADC Event and outlines specific immediate actions including thorough investigations, evidence preservation, and timely reporting of compromised PANs. It introduces precise timelines and procedural requirements, reflecting a more prescriptive approach compared to the prior more general guidance.
Security Rules and Procedures—Merchant Edition • 6 February 2024
result from a failure to provide requested information; a failure to cooperate with Mastercard investigation guidelines, procedures, practices, and the like; or a failure to ensure that Mastercard has reasonably unfettered access to the forensic examiner. A Customer may not, by refusing to cooperate with the Mastercard investigation, avoid a determination that there was an ADC Event. Should a Customer fail without good cause to comply with its obligations in this Chapter 10 or to respond fully and in a timely fashion to a request for information to which Mastercard is entitled in this Chapter 10, Mastercard may draw an adverse inference that information to which Mastercard is entitled, but that was not timely obtained as a result of the Customer’s noncompliance, would have supported or, where appropriate, confirmed a determination that there was an ADC Event. Before drawing such an adverse inference, Mastercard will notify the Customer of its noncompliance and give the Customer an opportunity to show good cause, if any, for its noncompliance. The drawing of an adverse inference is not exclusive of other remedies that may be invoked for a Customer’s noncompliance. The following provisions set forth requirements and procedures to which each Customer and its Agent(s) must adhere upon becoming aware of an ADC Event or Potential ADC Event.
Security Rules and Procedures—Merchant Edition • 6 August 2024
- The Customer or its Agent receives notification from Mastercard or any other source that the Customer or its Agent(s) has experienced an ADC Event or a Potential ADC Event; or
- The Customer or its Agent discovers or, in the exercise of reasonable diligence, should have discovered a security breach or unauthorized penetration of its own system or environment or the system or environment of its Agent(s). A Customer must notify Mastercard within 24 hours of becoming aware of an ADC Event or Potential ADC Event in or affecting any system or environment of the Customer or its Agent. In addition, a Customer must, by contract, ensure that its Agent notifies Mastercard within 24 hours when the Agent becomes aware of an ADC Event or Potential ADC Event in or affecting any system or environment of the Customer or the Agent. When a Customer or its Agent becomes aware of an ADC Event or Potential ADC Event either in any of its own systems or environments or in the systems or environments of its Agent(s), the Customer must take (or cause the Agent to take) the following actions, as set forth in the Account Data Compromise Program User Guide, unless otherwise directed in writing by Mastercard.
- Notify Mastercard of the ADC Event or Potential ADC Event within twenty-four (24) hours, and on an ongoing basis thereafter, submit to Mastercard all known or suspected facts concerning the ADC Event or Potential ADC Event, including, by way of example and not limitation, known or suspected facts as to the cause and source of the ADC Event or Potential ADC Event to the satisfaction of Mastercard.
- Immediately commence a thorough investigation into the ADC Event or Potential ADC Event in accordance with Section 10.5.
- Immediately, and no later than within twenty-four (24) hours, identify and preserve all information, in all media, concerning the ADC Event or Potential ADC Event, including:
- preserve and safeguard all potential evidence pertinent to a forensic examination of an ADC Event or Potential ADC Event using industry best practices;
- isolate compromised systems and media from the network using industry best practices;
- preserve all Intrusion Detection Systems, Intrusion Prevention System logs, all firewall, Web, database, and events logs;
- document all incident response actions thoroughly; and
- refrain from restarting or rebooting any compromised or potentially compromised system or taking equivalent or other action that would have the effect of eliminating or destroying information that could potentially provide evidence of an ADC Event or Potential ADC Event.
- As soon as possible and at the latest within seventy-two (72) hours, provide to Mastercard, in the required format, all primary account numbers (PANs) associated with Account data that were actually or potentially accessed or disclosed in connection with the ADC Event or Potential ADC Event and any additional information requested by Mastercard. As used herein, the obligation to obtain and provide PANs to Mastercard applies to any Mastercard or Maestro Account number in a bank identification number (BIN)/Issuer identification number (IIN) range assigned by Mastercard. This obligation applies regardless of how or why such PANs were received, processed, or stored, including, by way of example and not limitation, in Account Data Compromise Events
program: Chargeback Handling- authority: Mastercard SPME §10.1, §10.3, §10.4, and §11.5+ authority: Mastercard SPME 10.1, 10.3, 10.4, and 11.5acknowledgement_business_days: 1lifecycle_states:- first_presentment- chargeback- second_presentment- pre_arbitration- arbitrationevidence_requirements:first_presentment:- transaction_receipt- authorization_recordchargeback:- merchant_rebuttal_letter- delivery_confirmation- customer_communication- fraud_and_chargeback_data_analysis+ - adc_event_notificationsecond_presentment:- compelling_evidence- signed_cardholder_agreementpre_arbitration:- full_dispute_record- prior_correspondencearbitration:- full_dispute_record- arbitration_filingagent_owner: chargeback_agent- # Added evidence requirement for fraud and chargeback data analysis to address new MATCH reason codes- # related to excessive chargebacks and fraud ratios as introduced in Mastercard SPME §11.5 update,- # supporting compliance with chargeback management standards per Mastercard SPME §10.1 and §10.3.+ # Updated to incorporate the new Mastercard SPME §10.3 requirements mandating Customers and Agents to notify Mastercard within 24 hours of any Account Data Compromise (ADC) Event or Potential ADC Event,+ # including initiating thorough investigations and preserving all relevant evidence promptly. This change ensures chargeback handling processes align with these stricter timelines and procedural obligations.
Chargeback Handling
Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, acting as the acquirer, manages disputes from initial presentment through potential arbitration, adhering to Mastercard's requirements to protect all parties involved.
Lifecycle overview
Disputes progress through defined phases: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Compliance with evidence standards and timelines at each step is essential to prevent adverse rulings.
Required actions
-
Acknowledge incoming chargebacks within one business day.
-
Gather necessary evidence relevant to the dispute stage.
-
Submit second presentments when liability is disputable, supported by strong documentation.
-
Escalate to pre-arbitration and arbitration only after issuer rejection of second presentment.
-
Retain comprehensive case documentation for auditing and reporting purposes.
-
Provide all requested documentation promptly to Mastercard during investigations or appeals as governed by sections 10.3 and 10.4 of the Mastercard SPME.
7. Comply with the enhanced Account Data Compromise (ADC) Event requirements in Mastercard SPME §10.3, including mandatory notification to Mastercard within 24 hours upon awareness of an ADC or Potential ADC Event, immediate initiation of investigation and evidence preservation, and ongoing cooperation throughout the resolution process.
Monitoring and Risk Factors
Halyard Pay evaluates merchant risk using updated Mastercard MATCH Listing Reason Codes, including new, specific definitions for elevated chargeback and fraud concerns:
-
Laundering: Merchant presenting invalid transaction records rather than bona fide sales.
-
Excessive Chargebacks: Monthly Mastercard chargebacks exceed 1% of sales transactions with total chargebacks ≥ USD 5,000.
-
Excessive Fraud: Fraud-to-sales ratio of 8% or more, with at least 10 fraudulent transactions totaling USD 5,000+ in a calendar month.
These clarified definitions, part of Mastercard's updated SPME MATCH Listing Reason Codes (see section 11.5), guide Halyard Pay’s risk assessments and chargeback management protocols to align with Mastercard’s evolving standards.
Source authority: Mastercard SPME §§10.1, 10.3, 10.4, 11.5.
Chargeback Handling
Chargebacks are cardholder-initiated disputes against a transaction. Halyard Pay, acting as the acquirer, manages disputes from initial presentment through potential arbitration, adhering to Mastercard's requirements to protect all parties involved.
Lifecycle overview
Disputes progress through defined phases: first presentment, chargeback, second presentment (re-presentment), pre-arbitration, and arbitration. Compliance with evidence standards and timelines at each step is essential to prevent adverse rulings.
Required actions
-
Acknowledge incoming chargebacks within one business day.
-
Gather necessary evidence relevant to the dispute stage.
-
Submit second presentments when liability is disputable, supported by strong documentation.
-
Escalate to pre-arbitration and arbitration only after issuer rejection of second presentment.
-
Retain comprehensive case documentation for auditing and reporting purposes.
-
Provide all requested documentation promptly to Mastercard during investigations or appeals as governed by sections 10.3 and 10.4 of the Mastercard SPME.
7. Comply with the enhanced Account Data Compromise (ADC) Event requirements in Mastercard SPME §10.3, including mandatory notification to Mastercard within 24 hours upon awareness of an ADC or Potential ADC Event, immediate initiation of investigation and evidence preservation, and ongoing cooperation throughout the resolution process.
Monitoring and Risk Factors
Halyard Pay evaluates merchant risk using updated Mastercard MATCH Listing Reason Codes, including new, specific definitions for elevated chargeback and fraud concerns:
-
Laundering: Merchant presenting invalid transaction records rather than bona fide sales.
-
Excessive Chargebacks: Monthly Mastercard chargebacks exceed 1% of sales transactions with total chargebacks ≥ USD 5,000.
-
Excessive Fraud: Fraud-to-sales ratio of 8% or more, with at least 10 fraudulent transactions totaling USD 5,000+ in a calendar month.
These clarified definitions, part of Mastercard's updated SPME MATCH Listing Reason Codes (see section 11.5), guide Halyard Pay’s risk assessments and chargeback management protocols to align with Mastercard’s evolving standards.
Source authority: Mastercard SPME §§10.1, 10.3, 10.4, 11.5.
Source authority: Mastercard SPME §10.3.
--- a/policies/chargeback_handling/rules.yaml
+++ b/policies/chargeback_handling/rules.yaml
@@ -1,5 +1,5 @@
program: Chargeback Handling
-authority: Mastercard SPME §10.1, §10.3, §10.4, and §11.5
+authority: Mastercard SPME 10.1, 10.3, 10.4, and 11.5
acknowledgement_business_days: 1
lifecycle_states:
- first_presentment
@@ -16,6 +16,7 @@
- delivery_confirmation
- customer_communication
- fraud_and_chargeback_data_analysis
+ - adc_event_notification
second_presentment:
- compelling_evidence
- signed_cardholder_agreement
@@ -27,6 +28,5 @@
- arbitration_filing
agent_owner: chargeback_agent
-# Added evidence requirement for fraud and chargeback data analysis to address new MATCH reason codes
-# related to excessive chargebacks and fraud ratios as introduced in Mastercard SPME §11.5 update,
-# supporting compliance with chargeback management standards per Mastercard SPME §10.1 and §10.3.
+# Updated to incorporate the new Mastercard SPME §10.3 requirements mandating Customers and Agents to notify Mastercard within 24 hours of any Account Data Compromise (ADC) Event or Potential ADC Event,
+# including initiating thorough investigations and preserving all relevant evidence promptly. This change ensures chargeback handling processes align with these stricter timelines and procedural obligations.
--- a/policies/chargeback_handling/policy.md
+++ b/policies/chargeback_handling/policy.md
@@ -14,6 +14,7 @@
4. Escalate to pre-arbitration and arbitration only after issuer rejection of second presentment.
5. Retain comprehensive case documentation for auditing and reporting purposes.
6. Provide all requested documentation promptly to Mastercard during investigations or appeals as governed by sections 10.3 and 10.4 of the Mastercard SPME.
+7. Comply with the enhanced Account Data Compromise (ADC) Event requirements in Mastercard SPME §10.3, including mandatory notification to Mastercard within 24 hours upon awareness of an ADC or Potential ADC Event, immediate initiation of investigation and evidence preservation, and ongoing cooperation throughout the resolution process.
## Monitoring and Risk Factors