n early May 2004, I attended MasterCard International's West Coast Fraud Strategy Forum in Phoenix. Discussions during the Forum emphasized the growing problem of identity theft, fraud statistics, account data compromise and new card products. Other topics covered were Merchant Online Status Tracking (MOST) and the Excessive Chargeback Program, which are significant areas for the ISO/MLS community.

MOST

In a recent reminder to its member financial institutions, MasterCard reinforced the MOST mandates. MasterCard originally announced the MOST system in its Aug. 15, 2003 Global Security Bulletin No. 8; the associations asked acquirers to register for MOST by March 31, 2004.

As of April 1, 2004 acquirers must also use MOST to submit responses regarding merchants identified in the program for exceeding MasterCard-defined fraud thresholds. Each initial identified merchant response not submitted via the MOST system is subject to a US$100 "processing fee" beginning April 1, 2004.

This is a one-time only assessment per merchant violation. If you are an ISO responsible for your own MasterCard fraud reporting, you need to sign up for MOST to prevent being charged for processing fees.

There are no registration or other fees required to use the MOST system. Registration is simple: Licensed MasterCard Online users go to MasterCard Online, www.mastercardonline.com, login and under the Fraud/Risk Management column, go to the Product Information Catalogue menu, click on the Merchant Online Status Tracking (MOST) link and complete the online Product Registration Form.

In the MOST system, a user must be licensed for each acquiring Interbank Card Association (ICA)-MasterCard's equivalent of Visa's BIN-regardless of what MasterCard calls a "parent/child relationship." (ICA members are parents; children are ISOs, MSPs, etc.) In addition to submitting the request via MasterCard Online to register for MOST access, a user must also provide written authorization from the Principal, Security or MATCH contact listed in the Member Information Manual for the respective ICA.

MasterCard regional Security and Risk Management representatives handle questions and problems. Contact MasterCard Online Solutions and Services Help Desk for the U.S. region at 800-737-5019 for registration support; access technical support by calling 800-288-3381 or by e-mail at mosthelp@mastercard.com.

Excessive Chargeback Program

MasterCard laid out the consolidation of various excessive chargeback programs into a global standard, called the Excessive Chargeback Program ("the Program"), as announced in the June 3, 2002 Global Operations Bulletin No. 6.

The Program's standards apply to merchant locations that, for two consecutive months, have exceeded MasterCard's chargeback thresholds; criteria include:

• A minimum of 15 chargebacks
• A monthly ratio of chargeback dollar volume-to-interchange sales volume of greater than 2.5%
• A monthly ratio of the number of chargeback transactions-to-total sales transactions of greater than 1%

The Program stipulates a recovery fee structure (i.e. fines) and provides for issuer reimbursement. MasterCard can also, in its sole discretion, request that an acquirer terminate a merchant that has exceeded the excessive chargeback thresholds as described above. Recovery fees are structured as follows*:

• Months 1 - 2 None
• Months 3 - 5 $25 per chargeback; a $25,000 fee
• Months 6 - 7 $50 per chargeback; a $50,000 fee
• Months 8 - 9 $75 per chargeback; a $75,000 fee
• Months 10 + $100 per chargeback; a $100,000 fee

MasterCard will consider a credit to a chargeback if it believes, in its sole discretion, that the member generated the credit to avoid applicability of the Program rules. The recover fee for credits so designated is $25 for each credit processed. It is also the acquirer's responsibility to monitor for excessive credits.

MasterCard can also initiate an audit to determine whether an acquirer failed to monitor chargeback thresholds for their merchants. You know who pays for the audit.

Key-entry telecom merchants, electronic commerce adult content (videotext) merchants and merchants identified under the Excessive Chargeback Program must be registered with MasterCard and provide all of the information requested.

A $1,000 registration fee is required for electronic commerce adult content (videotext) merchants and merchants identified under the Excessive Chargeback Program.

There is also a minimum Tier 1 capital requirement of three times the aggregate of all the bankcard transactions processed by the member's electronic commerce adult content (videotext) merchants and merchants identified under the Excessive Chargeback Program in each month.

MasterCard may assess a fine on an acquiring member with merchants, including those listed above for not first registering the merchant in accordance with the Program requirements. The first violation results in a fine of up to $5,000 and each subsequent violation may result in a fine of up to $25,000. The acquirer must also ensure that the action or inaction that resulted in the violation is corrected promptly.

For electronic commerce adult content (videotext) merchants and merchants identified under the Excessive Chargeback Program with monthly fraud in excess of $25,000 the fines are increased to:

• Month 1 $25,000
• Month 2 $100,000
• Month 3 $150,000

It is the acquirer's responsibility to monitor its merchants in accordance with MasterCard's requirements.

If the acquirer determines as a result of routine monitoring or periodic audits, that the Excessive Chargeback Program thresholds were exceeded, it must immediately notify MasterCard Security and Risk Management staff and declare the merchant an Excessive Chargeback Merchant.

Now that this Program has been in place for two years, I think that ISOs and member banks should expect increased enforcement activity by MasterCard.

If you are not in compliance it would be a good idea to get your organization up to speed with the Program requirements ASAP.

David H. Press is Principal and President of Integrity Bankcard Consultants, Inc. Phone him with questions at 630-637-4010, e-mail him at dhp@integritybankcard.net or visit www.integritybankcard.net.