program: ATO Detection
- authority: Mastercard SPME 10.6.2.1, 10.6.4
+ authority: Mastercard SPME 10.6.2.1, 10.6.4, 11.10
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent
 
# This ATO Detection policy incorporates Mastercard SPME .6.4 updates that affect Account Data Compromise (ADC) event mitigation. It adjusts risk evaluation processes by recognizing that merchants in the U.S. and Canada with high tokenization rates and e-commerce transaction volumes may benefit from reduced or waived reimbursement requirements during such events. This complements detection signal thresholds by informing downstream operational decisions on ADC events, ensuring alignment with Mastercard's revised criteria for operational reimbursement and event assessment.
+ #
+ # Per Mastercard SPME §11.10, any request to remove a MATCH Merchant listed under reason code 12 must now include an acquirer's attestation of PCI DSS compliance and a validation letter from a Mastercard certified forensic examiner certifying such compliance. If the acquirer cannot or will not submit the request, the merchant may submit it directly following the same process. This affects the ATO Detection policy by reinforcing compliance and validation requirements for MATCH listings tied to Account Takeover risk management.

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to a cardholder's account and initiates transactions without the cardholder's consent. Halyard Pay implements real-time risk scoring on authentication events and enforces a mandatory 3DS (3-D Secure) challenge for any session where the computed risk score meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies inconsistent with a cardholder's established pattern, changes to device fingerprint, transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

1. Evaluate each authentication event against the defined signal list in real time.

2. Compute a normalized risk score between 0.0 and 1.0.

3. If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before authorizing the transaction.

4. Log all ATO signals and outcomes in the case management system.

5. Escalate persistent high-risk accounts to the ATO response team for manual review.

6. In the event of an Account Data Compromise (ADC), ensure that any Terminal Servicer (TS) involved promptly initiates a forensic investigation by a PCI Forensic Investigator (PFI) within 72 hours, and completes it as soon as practical.

7. Confirm that all involved Terminal Servicers revalidate PCI DSS compliance within 90 calendar days after the conclusion of the forensic investigation and demonstrate compliance with the PCI DSS Data Encryption and Software Validation (DESV) appendix within 12 months, per Mastercard SPME §10.6.2.1.

8. Assure registration of any Terminal Servicer(s) associated with the ADC Event through Mastercard Connect within 10 calendar days of awareness, and confirm full cooperation with Mastercard and law enforcement authorities.

9. Verify timely receipt by Mastercard of unedited forensic examination findings.

10. Ensure that all required containment actions identified in forensic reports are completed by the Terminal Servicers involved.

11. For any MATCH Merchant listed under reason code 12, ensure that removal requests include the Acquirer's attestation of the merchant's PCI DSS compliance and a certificate from a Mastercard certified forensic examiner verifying compliance, or allow the Merchant to submit this request directly following the same process, as mandated by Mastercard SPME §11.10.

These enhanced controls reinforce Halyard Pay’s adherence to Mastercard’s strengthened ADC event and MATCH Merchant removal protocols, supporting minimized risk and financial exposure through compliance and timely remediation.

Source authority: Mastercard SPME §6.2, §10.6.2.1.§10.6.2.1, §11.10.