Halyard Pay · Policy Updates Powered by Carver Agents

Mastercard SPME §8.4 · Feb 2024 → Sep 2024

Questionable Merchant Audit Program (QMAP)

substantive

The criteria defining Questionable Merchants for Brazil were revised. Previously, the criteria applied directly, but now, at least three of four specific conditions must be met during the Case Scope Period, aligning Brazil's criteria with the general structure. This change clarifies and formalizes the assessment threshold for Brazil-specific cases.

Sources Mastercard SPME · Feb 2024 · page 77 PDF Mastercard SPME · Sep 2024 · page 80 PDF Fraud Monitoring current
Also in §8.x this release breaking §8.4.2 Mastercard Commencement of an Investigation substantive §8.3.1 ECP Definitions substantive §8.4.7 Chargeback Responsibility substantive §8.4.8 Fraud Recovery substantive §8.6.2 Investigation Process
Why these edits? The change in Section 8.4 clarifies that, for Brazil, at least three of four specific conditions must be met to classify a merchant as Questionable, aligning the Brazilian criteria with the general definition, affecting how fraud monitoring thresholds are applied for Brazil-specific merchants.
Mastercard SPME §8.4
Security Rules and Procedures—Merchant Edition • 6 February August 2024 f. No payment has been made of charges to the account; or g. The Issuer closed the account after a failed payment (dishonored check or the like) of charges to the account. Case Scope Period means the 120-calendar-day period preceding the date on which Mastercard commences an investigation into the activities of a suspected Questionable Merchant. Questionable Merchant means a Merchant that satisfies all of the following criteria: 1. The Merchant submitted at least USD 50,000 in Transaction volume during the Case Scope Period; 2. The Merchant submitted at least five (5) Transactions to one or more Acquirers during the Case Scope Period; and 3. At least fifty (50) percent of the Merchant's total Transaction volume involved the use of Cardholder bust-out accounts OR At least three (3) of the following four (4) conditions apply to the Merchant's Transaction activity during the Case Scope Period: a. The Merchant's fraud-to-sales Transaction ratio was seventy (70) percent or greater. b. At least twenty (20) percent of the Merchant's Transactions submitted for authorization were declined by the Issuer or received a response of "01-Refer to issuer" during the Case Scope Period. c. The Merchant has been submitting Transactions for fewer than six (6) months. d. The Merchant's total number or total dollar amount of fraudulent Transactions, authorization declines, and Issuer referrals was greater than the Merchant's total number or total dollar amount of approved Transactions. OR For the country of Brazil: At least three (3) of the following four (4) conditions apply to the Merchant's Transaction activity during the Case Scope Period: a. Case scope period: 120 calendar days preceding the date Mastercard commences an investigation into the activities of a suspected Merchant; b. Card-present Transactions (POS entry mode 05 or 07) and CNP Transactions (POS entry modes 10 and 81) that are 3DS fully-authenticated; c. Minimum of BRL 100,000 in fraudulent Transactions reported per Acquirer under fraud type 56 (within the case scope period); d. The Merchant's fraud to sales ratio was seventy-five percent (75%) or higher based on fraud reported under the code "56-Manipulation of Cardholder." NOTE: Transaction activity ("on-us" or otherwise) that is not processed through Mastercard systems is not considered in determining whether a Merchant meets the criteria of a Questionable Merchant. Mastercard has sole discretion, based on information from any source, to determine whether a ¶ Merchant meeting these criteria is a Questionable Merchant. ¶ Mastercard Fraud Control Programs
Halyard Pay · 2 files
program: Fraud Monitoring


- authority: Mastercard SPME §3.7, §8.6.6, §11.1.1


+ authority: Mastercard SPME 2.4, 3.7, 8.6.6, 11.1.1


fraud_to_sales_ratio_threshold: 0.015


min_count_per_month: 100


monitoring_cadence: monthly


escalation_actions:


  - escalate_to_human_review


  - notify_acquirer


  - provide_incident_report_to_mastercard_fraud_control_programs  # Added to meet new SPME requirements


lookback_period_months: 1


remediation_review_interval_days: 30


agent_owner: fraud_ops_agent


 


- # MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.


+ # MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME 11.1.1.


# Acquirers may add and search for information on up to five principal owners per Merchant.


# Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.


# Retroactive alert processing is supported for data up to 360 days old.


# Acquirers control receipt and detail of inquiry match information.


# Real-time access via MATCH Online and API, and batch operations remain available.


# Merchant URL information may be added and searched.


# After obtaining MATCH inquiry results, acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.


#


- # New requirements under SPME §8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.


+ # New requirements under SPME 8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.


# Merchants subject to a subsequent claim of coercion within 12 months will be added with reason code 00 (Questionable Acquirer/Under Investigation).


# If the claim is confirmed to meet Coercion Program criteria, the MATCH record will be updated to reason code 24.


# If not confirmed, the MATCH record will be deleted.


# These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.


#


- # New SPME §11.1.1 further requires acquirers to submit incident reports to Mastercard Fraud Control Programs when violations are not reported by the Acquirer's MMSP, strengthening incident response and reporting cadence.


- 


+ # New SPME 11.1.1 further requires acquirers to submit incident reports to Mastercard Fraud Control Programs when violations are not reported by the Acquirer's MMSP, strengthening incident response and reporting cadence.


+ #


+ # The updated SPME 8.4 clarifies the definition of Questionable Merchant criteria for Brazil, requiring at least three of four specified conditions to be met, aligning with the general criteria applied internationally.


+ # Acquirer fraud monitoring rules should reflect this by applying these combined conditions when evaluating Brazil-based merchants for risk and investigation triggers.

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.

  5. Pay special attention to country-specific fraud criteria, including the updated Brazilian threshold where a merchant must meet at least three of four specified conditions regarding transaction volume, 3DS authentication, reported fraud amounts, and fraud-to-sales ratio to be classified as a Questionable Merchant.

6. After accessing MATCH data, data and applying country-specific fraud definitions, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

6. 7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

7. 8. Track case progress until the account returns to threshold compliance or is terminated.

8. 9. If any fraud violation is detected but not reported by Halyard Pay as the Acquirer's MMSP, escalate the incident report to Mastercard's Fraud Control Programs in accordance with Mastercard SPME §11 protocols.

Source authority: Mastercard SPME §3.7, §8.4, §8.6.6, §11.1.1, and §11.

policies/fraud_monitoring/policy.md — after applying change

Fraud Monitoring

Halyard Pay monitors merchant fraud activity and leverages Mastercard's MATCH system for enhanced fraud risk assessment on merchants processed through our platform.

When this policy applies

This policy applies to all merchants processed by Halyard Pay where Mastercard is the applicable network, covering both card-present and card-not-present transactions.

Required actions

  1. Compute the merchant's rolling fraud-to-sales ratio each calendar month.

  2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.

  3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.

  4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.

  5. Pay special attention to country-specific fraud criteria, including the updated Brazilian threshold where a merchant must meet at least three of four specified conditions regarding transaction volume, 3DS authentication, reported fraud amounts, and fraud-to-sales ratio to be classified as a Questionable Merchant.

6. After accessing MATCH data, data and applying country-specific fraud definitions, conduct a risk assessment to determine whether further investigation or additional measures are warranted.

6. 7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.

7. 8. Track case progress until the account returns to threshold compliance or is terminated.

8. 9. If any fraud violation is detected but not reported by Halyard Pay as the Acquirer's MMSP, escalate the incident report to Mastercard's Fraud Control Programs in accordance with Mastercard SPME §11 protocols.

Source authority: Mastercard SPME §3.7, §8.4, §8.6.6, §11.1.1, and §11.

Source authority: Mastercard SPME §8.4.

--- a/policies/fraud_monitoring/rules.yaml
+++ b/policies/fraud_monitoring/rules.yaml
@@ -1,5 +1,5 @@
 program: Fraud Monitoring
-authority: Mastercard SPME §3.7, §8.6.6, §11.1.1
+authority: Mastercard SPME 2.4, 3.7, 8.6.6, 11.1.1
 fraud_to_sales_ratio_threshold: 0.015
 min_count_per_month: 100
 monitoring_cadence: monthly
@@ -11,7 +11,7 @@
 remediation_review_interval_days: 30
 agent_owner: fraud_ops_agent
 
-# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME §11.1.1.
+# MATCH fraud detection features are limited to principal owners only; associate owners and Service Provider name reporting are removed per SPME 11.1.1.
 # Acquirers may add and search for information on up to five principal owners per Merchant.
 # Multiple data fields are used to determine matches; MATCH supports editing and error notification to reduce delays.
 # Retroactive alert processing is supported for data up to 360 days old.
@@ -20,11 +20,13 @@
 # Merchant URL information may be added and searched.
 # After obtaining MATCH inquiry results, acquirers must assess whether further investigation or risk mitigation actions are warranted, per updated SPME requirements.
 #
-# New requirements under SPME §8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.
+# New requirements under SPME 8.6.6 specify that Mastercard will add Merchants to MATCH using reason code 24 (Illegal Transactions) when Merchants meet Coercion Program criteria.
 # Merchants subject to a subsequent claim of coercion within 12 months will be added with reason code 00 (Questionable Acquirer/Under Investigation).
 # If the claim is confirmed to meet Coercion Program criteria, the MATCH record will be updated to reason code 24.
 # If not confirmed, the MATCH record will be deleted.
 # These provisions enhance fraud monitoring by requiring tracking of coercion-related transaction risks.
 #
-# New SPME §11.1.1 further requires acquirers to submit incident reports to Mastercard Fraud Control Programs when violations are not reported by the Acquirer's MMSP, strengthening incident response and reporting cadence.
-
+# New SPME 11.1.1 further requires acquirers to submit incident reports to Mastercard Fraud Control Programs when violations are not reported by the Acquirer's MMSP, strengthening incident response and reporting cadence.
+#
+# The updated SPME 8.4 clarifies the definition of Questionable Merchant criteria for Brazil, requiring at least three of four specified conditions to be met, aligning with the general criteria applied internationally.
+# Acquirer fraud monitoring rules should reflect this by applying these combined conditions when evaluating Brazil-based merchants for risk and investigation triggers.

--- a/policies/fraud_monitoring/policy.md
+++ b/policies/fraud_monitoring/policy.md
@@ -12,9 +12,10 @@
 2. If the ratio meets or exceeds 1.5% and the fraud count reaches at least 100 transactions in that month, escalate the merchant account to human review immediately.
 3. Utilize Mastercard's MATCH system data focusing on principal owners only, as per the updated Mastercard SPME guidelines. Do not consider associate owners or Service Provider names in fraud assessments.
 4. Maintain awareness of Mastercard's MATCH reason codes related to coercion programs: merchants may be added with reason code 24 for illegal transactions upon meeting coercion criteria, or with code 00 if a subsequent coercion claim arises within 12 months; records must be updated or removed based on confirmation of these claims.
-5. After accessing MATCH data, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
-6. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
-7. Track case progress until the account returns to threshold compliance or is terminated.
-8. If any fraud violation is detected but not reported by Halyard Pay as the Acquirer's MMSP, escalate the incident report to Mastercard's Fraud Control Programs in accordance with Mastercard SPME §11 protocols.
+5. Pay special attention to country-specific fraud criteria, including the updated Brazilian threshold where a merchant must meet at least three of four specified conditions regarding transaction volume, 3DS authentication, reported fraud amounts, and fraud-to-sales ratio to be classified as a Questionable Merchant.
+6. After accessing MATCH data and applying country-specific fraud definitions, conduct a risk assessment to determine whether further investigation or additional measures are warranted.
+7. Notify the acquiring compliance officer and document the case ID with supporting transaction data.
+8. Track case progress until the account returns to threshold compliance or is terminated.
+9. If any fraud violation is detected but not reported by Halyard Pay as the Acquirer's MMSP, escalate the incident report to Mastercard's Fraud Control Programs in accordance with Mastercard SPME §11 protocols.
 
-Source authority: Mastercard SPME §3.7, §8.6.6, §11.1.1, and §11.+Source authority: Mastercard SPME §3.7, §8.4, §8.6.6, §11.1.1, and §11.