Mastercard instituted a new scam prevention program last week, seeking to draw merchants and their acquiring banks into the fight against fraud.

The card network now requires acquiring banks that process Mastercard payments for retailers, restaurants and other merchants to follow up within three days on certain flagged fraud activity. New rules under Mastercard’s Scam Merchant Monitoring Program went into effect Friday, according to a panel discussion at the Midwest Acquirers Association’s annual conference last week. 

“There's a lot of concern that's coming out of Washington about consumers being scammed, and if you think about authorized transactions, where a consumer was fraudulently induced to engage in that transaction, that's one of the things that the networks are concerned about,” industry consultant Ken Musante said in a Monday interview. 

The new Mastercard program, also called SMMP, follows a similar move by the company’s larger rival Visa, which last year instituted the Visa Acquirer Monitoring Program, or Vamp, to press merchants and their banks to better combat fraud.

In May, Mastercard reminded merchants and their banks in a post on its website that it would be revising its approach this month to “drive greater consistency in fraud mitigation efforts.” Specifically, the Purchase, New York-based company emphasized a new time frame for addressing suspected scams.

Mastercard said it was “compressing the window between suspicious signals and enforcement by requiring acquirers and payment facilitators to actively monitor merchant behavior and to initiate an investigation within 72 hours when potential scam activity hits a certain risk threshold.”

At the conference in Chicago, a panel moderated by Musante discussed the campaigns by Visa and Mastercard to better combat schemes by criminals aimed at tricking consumers into making authorized payments. While fraud via unauthorized payments has long been a problem in the industry, there has been a surge in recent years of authorized payments by consumers under false pretenses due to scams. 

“SMMP is specifically designed to address scams involving consumer manipulation,” Musante said during the Thursday panel discussion. “Unauthorized transactions review is no longer sufficient because these are authorized transactions. And so, under SMMP, acquirers are required to monitor merchant activity across a defined set of risk indicators.”

While the bank acquirers have already been monitoring their merchant client transactions for a lot of those risky patterns, the key change now is that they’re under the obligation to take action on any suspicious activity within a relatively short timeframe.

“Acquirers have to respond within 72 hours – that's a pretty big deal that you have to have evidence of a response,” Musante said in leading the discussion with two panelists, Visa Director Anush Amiryants and Richard Parrott, the vice president of risk and compliance for Talus Pay, a brand of processing services at AMCP Payments Intermediate.

The merchant can be flagged for a variety of reasons, including a “sharp drop” in card payment authorizations, a bank card issuer reporting a scam or Mastercard issuing an alert, according to Musante. “If scam activity is confirmed, the acquirer is required to take action,” he noted.

Specifically, the acquirer, and any other third parties it draws into the review, must investigate the merchant’s situation and potentially take further steps, depending on the outcome of the probe, he said. The bank acquirers must give additional scrutiny to merchants that have a processing track record of less than six months under the revised rules.

San Francisco-based Visa instituted its Vamp last year also to address rising fraud. 

The company is seeing positive results from the program, said Amiryants, who has oversight for global payment ecosystem risk and controls. “VAMP is delivering real value, not just to acquirers, but across the whole ecosystem,” she said on the Thursday panel. “We're talking about issuers, acquirers, and very important us, consumers.”

Visa’s chief risk and client services officer, Paul Fabara, pointed to a quantified benefit in a March website post. “Nearly half of acquirers identified in the program improved performance within a single quarter, demonstrating that remediation is both achievable and timely when signals and behaviors are aligned,” he said.

The Visa program is different in that it is tied to newly calibrated fee discounts and fines for merchants geared to goals for fraud prevention and transaction dispute management.

Both programs were designed to address the broader ecosystem of intermediaries that touch a payments transaction even though the bank acquirer is ultimately responsible to the card networks. However, they differ in that Mastercard imposes the specific new requirement of investigating within three days while Visa still leaves the decision-making up to the processing parties, albeit with new possible incentives and penalties involved.

Mastercard is saying, essentially, “you better make sure that …you have your hands on the wheel at all times,” Musante said in the interview. “You've got to investigate and, if appropriate, act on this scam notice.”