Mastercard SPME §10.4 · Feb 2024 → Sep 2024
Forensic Report
The revised section requires the responsible Customer or Agent to ensure the PFI retains all draft forensic reports related to ADC events and provides them to Mastercard upon request. Mastercard may also require a PCI gap analysis included in the final report, and the PFI must submit preliminary and final reports promptly to Mastercard.
Security Rules and Procedures—Merchant Edition • 6 February 2024
The responsible Customer determines that the Merchant (or other Agent) uses a payment acceptance system that does not share connectivity with another Merchant (or Agent) or Merchant's (or Agent's) system and that is not operated by a Service Provider. Should Mastercard determine that the subject of the Event is a Level 2, 3, or 4 Merchant and that Criteria A and B, above, are satisfied, Mastercard will provide notice to the responsible Customer by way of an email message to the responsible Customer's Security Contact listed in the My Company Manager application then available on Mastercard Connect®. Upon receipt of such notice, the responsible Customer may elect to cause a PFI to conduct an examination of the Merchant or other Agent in accordance with section 10.3.1 of this Chapter
The responsible Customer (or its Agent) must ensure that the PFI retains and safeguards all draft forensic report(s) pertaining to the ADC Event or Potential ADC Event and, upon request of Mastercard, immediately provides to Mastercard any such draft. The PFI should adhere to the PFI Program Guide as it pertains to the work products produced by the PFI. Mastercard may require the Customer to cause a PFI to conduct a PCI gap analysis and include the result of that analysis in the final forensic report. The Customer must direct the PFI to submit a copy of the preliminary and final forensic reports to Mastercard immediately upon completion. Account Data Compromise Events
program: Refund Policyauthority: Mastercard SPME 7 10.4, 10.7refund_window_days: 30partial_refund_allowed: truenotification_required_to_cardholder: truenotification_channels:- in_apprecord_retention_months: 18non_returnable_goods_refund_exception: falseagent_owner: refunds_agent- # Updated to reflect Mastercard's continued obligations for customers to submit information during investigations and the appeal process requirements under SPME 7 10.7+ # Clarified responsibilities for Customer and their Agent regarding retention and provision of draft forensic reports and PCI gap analysis as per Mastercard SPME §10.4 updates
Refund Policy
Merchants processing transactions on the Mastercard network must maintain and honor a clearly defined refund policy. Halyard Pay requires merchants to process refunds within 30 days of a valid refund request and notify cardholders when refunds are initiated or declined.
When this policy applies
This policy applies to all transaction types where a cardholder requests a refund directly from the merchant, distinct from chargeback disputes initiated through the card network. Merchants must not require cardholders to return goods before issuing a refund when goods are non-returnable by nature.
Required actions
-
Accept refund requests within 30 days following the original transaction.
-
Partial refunds are permissible where a portion of the goods or services is non-defective.
-
Notify cardholders in writing (email or in-app notification) when refunds are processed or declined.
-
Retain refund transaction records for a minimum of 18 months.
-
Submit to Mastercard ongoing documentation as required during investigations related to refunds or financial responsibility determinations, per Mastercard SPME sections 10.3 and 10.4.
Merchants must cooperate fully with Mastercard’s investigation process and understand process, including the retention and prompt provision of all forensic or investigative reports related to disputes or incidents upon request. Merchants should be aware that failure to provide requested information investigations informed by these reports may limit their ability to appeal determinations regarding affect financial responsibility. responsibility determinations. Appeals must be timely, specify the basis for contention, and adhere to Mastercard’s standards; a non-refundable USD 500 fee applies to review appeals.
Source authority: Mastercard SPME §10.4 and §10.7.
Refund Policy
Merchants processing transactions on the Mastercard network must maintain and honor a clearly defined refund policy. Halyard Pay requires merchants to process refunds within 30 days of a valid refund request and notify cardholders when refunds are initiated or declined.
When this policy applies
This policy applies to all transaction types where a cardholder requests a refund directly from the merchant, distinct from chargeback disputes initiated through the card network. Merchants must not require cardholders to return goods before issuing a refund when goods are non-returnable by nature.
Required actions
-
Accept refund requests within 30 days following the original transaction.
-
Partial refunds are permissible where a portion of the goods or services is non-defective.
-
Notify cardholders in writing (email or in-app notification) when refunds are processed or declined.
-
Retain refund transaction records for a minimum of 18 months.
-
Submit to Mastercard ongoing documentation as required during investigations related to refunds or financial responsibility determinations, per Mastercard SPME sections 10.3 and 10.4.
Merchants must cooperate fully with Mastercard’s investigation process and understand process, including the retention and prompt provision of all forensic or investigative reports related to disputes or incidents upon request. Merchants should be aware that failure to provide requested information investigations informed by these reports may limit their ability to appeal determinations regarding affect financial responsibility. responsibility determinations. Appeals must be timely, specify the basis for contention, and adhere to Mastercard’s standards; a non-refundable USD 500 fee applies to review appeals.
Source authority: Mastercard SPME §10.4 and §10.7.
Source authority: Mastercard SPME §10.4.
--- a/policies/refund_policy/rules.yaml +++ b/policies/refund_policy/rules.yaml @@ -10,4 +10,4 @@ non_returnable_goods_refund_exception: false agent_owner: refunds_agent -# Updated to reflect Mastercard's continued obligations for customers to submit information during investigations and the appeal process requirements under SPME 7 10.7+# Clarified responsibilities for Customer and their Agent regarding retention and provision of draft forensic reports and PCI gap analysis as per Mastercard SPME §10.4 updates --- a/policies/refund_policy/policy.md +++ b/policies/refund_policy/policy.md @@ -14,6 +14,6 @@ 4. Retain refund transaction records for a minimum of 18 months. 5. Submit to Mastercard ongoing documentation as required during investigations related to refunds or financial responsibility determinations, per Mastercard SPME sections 10.3 and 10.4. -Merchants must cooperate fully with Mastercard’s investigation process and understand that failure to provide requested information may limit their ability to appeal determinations regarding financial responsibility. Appeals must be timely, specify the basis for contention, and adhere to Mastercard’s standards; a non-refundable USD 500 fee applies to review appeals. +Merchants must cooperate fully with Mastercard’s investigation process, including the retention and prompt provision of all forensic or investigative reports related to disputes or incidents upon request. Merchants should be aware that investigations informed by these reports may affect financial responsibility determinations. Appeals must be timely, specify the basis for contention, and adhere to Mastercard’s standards; a non-refundable USD 500 fee applies to review appeals. -Source authority: Mastercard SPME §10.4 and §10.7.+Source authority: Mastercard SPME §10.4 and §10.7.