Halyard Pay policy

ATO Detection

16 proposed revisions across 4 of 5 reviewed releases.

Current policy

policy.md

Account-Takeover (ATO) Detection

Account-takeover fraud occurs when a malicious actor gains unauthorized access to a cardholder's account and initiates transactions without the cardholder's consent. Halyard Pay implements real-time risk scoring on authentication events and enforces a mandatory 3DS (3-D Secure) challenge for any session where the computed risk score meets or exceeds the defined threshold.

Detection signals

The risk model incorporates multiple behavioral signals: geographic anomalies inconsistent with a cardholder's established pattern, changes to device fingerprint, transaction velocity breaches, and indicators of credential-stuffing activity.

Required actions

Evaluate each authentication event against the defined signal list in real time.
Compute a normalized risk score between 0.0 and 1.0.
If the risk score is 0.5 or greater, trigger a mandatory 3DS challenge before authorizing the transaction.
Log all ATO signals and outcomes in the case management system.
Escalate persistent high-risk accounts to the ATO response team for manual review.

Source authority: Mastercard SPME §6.2.

rules.yaml

program: ATO Detection
authority: Mastercard SPME §6.2
risk_threshold_for_3ds_challenge: 0.5
risk_score_range: [0.0, 1.0]
signals:
  - geo_anomaly
  - device_fingerprint_change
  - velocity_breach
  - credential_stuffing
challenge_method: 3ds_v2
persistent_risk_escalation_threshold: 3
persistent_risk_lookback_days: 7
agent_owner: ato_agent