Fraud and Security Notice

Data Access & Collection · Company practice

Mastercard may process transaction and fraud-risk data about you

Mastercard lists transaction data, fraud and authentication risk scores, transaction risk factors, location data, merchant details, items purchased, information about disputed transactions and confirmed fraudulent activity among the personal information it may process.

Supporting quotations

This may include:

Transaction data, fraud and authentication risk scores, transaction risk factors, location data, merchant details, items purchased, information about disputed transactions and confirmed fraudulent activity.

Qualifications & exceptions

• Introduced as personal information the notice says 'may include', not as data collected about every person.

Data Access & Collection · Company practice

Mastercard may process blockchain and cryptocurrency transaction information

Mastercard lists certain information gathered from the blockchain, including blockchain address, other cryptocurrency transaction details and IP address, among the personal information it may process.

Supporting quotations

Certain information gathered from the blockchain, including blockchain address, other cryptocurrency transaction details and IP address.

Qualifications & exceptions

• Described as 'certain' information, within a list the notice says 'may include' these items.

Data Access & Collection · Company practice

Mastercard may collect device and interaction data through cookies and web beacons

Mastercard lists information collected by automated means such as cookies and web beacons among the personal information it may process, including IP address, browser type, operating system, mobile device unique identifier, geographical area, referring URLs and information on actions taken or interaction with its digital assets.

Supporting quotations

Certain information about you collected via automated means such as cookies and web beacons when you interact with our ads, mobile apps, or visit our websites, pages or other digital assets, such as IP address, browser type, operating system, mobile device unique identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets.

Qualifications & exceptions

• Collected when you interact with Mastercard's ads or mobile apps, or visit its websites, pages or other digital assets.

Not stated here

• This passage does not describe any choice to decline cookies or web beacons.

Data Access & Collection · Company practice

Some Mastercard products use behavioral data from your device interactions for fraud prevention

Mastercard says some of its online products and services include advanced fraud prevention technology that uses behavioral data based on your device interactions, such as face ID, fingerprints, keystroke timing, scroll position and mouse-location.

Supporting quotations

Some of our online products and services also include advanced fraud prevention technology using behavioral data based on your device interactions, such as face ID, fingerprints, keystroke timing, scroll position and mouse-location.

Qualifications & exceptions

• Applies to 'some' of Mastercard's online products and services, not all of them.

Not stated here

• The notice does not say which products and services use this behavioral data.
• The notice does not say how long behavioral data such as face ID or fingerprints is kept.

Data Access & Collection · Company practice

Mastercard may process publicly available data about sole proprietors and cryptocurrency companies

Mastercard lists publicly available data among the personal information it may process, described as including the information technology profile and assets of sole proprietors and cryptocurrency companies, such as domains, location data and cookies, contact details in public web pages or domain registration information, residential IP addresses in reputation lists, sanctions lists, and authorship of published intelligence about cyber security threats.

Supporting quotations

Publicly available data including information technology profile and assets of sole proprietors and cryptocurrency companies, such as domains, location data and cookies, contact details in public web pages or domain registration information, residential IP addresses in reputation lists, sanctions lists, and authorship of published intelligence about cyber security threats.

Qualifications & exceptions

• The data described concerns sole proprietors and cryptocurrency companies.

Data Access & Collection · Company practice

Mastercard may process identity verification data such as national identification number

Mastercard lists identity verification data among the personal information it may process, such as name, address, national identification number, mobile phone number, age and nationality.

Supporting quotations

This may include:

Identity verification data such as name, address, national identification number, mobile phone number, age, and nationality.

Qualifications & exceptions

• Listed as examples ('such as') within personal information the notice says 'may include' these items.

Data Access & Collection · Company practice

Mastercard may process fraud and risk data about sole proprietors, owners and cryptocurrency companies

Mastercard lists fraud and risk data of sole proprietor and principal owner merchants and cryptocurrency companies among the personal information it may process. It says this may include name and contact information of the companies' management personnel, and a fraud reason code.

Supporting quotations

Fraud and risk data of sole proprietor, principal owner merchants and cryptocurrency companies, which may include name and contact information of the companies’ management personnel, and fraud reason code.

Qualifications & exceptions

• Concerns sole proprietor and principal owner merchants and cryptocurrency companies.

Data Access & Collection · Company practice

Mastercard says it gets this information from institutions, merchants, you and third parties

Mastercard says it obtains the categories of personal information above from financial institutions and merchants, from your service providers, directly from you, from third parties as detailed below, or from your interaction with its digital assets.

Supporting quotations

We obtain the above categories of Personal Information from various sources: from financial institutions and merchants, from your service providers, directly from you, from third parties as detailed below or from your interaction with our digital assets.

Not stated here

• The notice does not say which category of information comes from which source.