Fraud and Security Notice

Security & Safeguards · Context

Mastercard calls safety and security its top priority

The notice opens by saying safety is Mastercard's number one priority. It says that consumers, merchants, issuers, businesses and public sector organizations can have peace of mind that their safety and security is that priority, and that because there is no single fix for fraud Mastercard uses multiple layers of security. These passages state goals and an approach; they do not set out a specific standard, guarantee or remedy.

Supporting quotations

Safety is Mastercard's number one priority.

Whether you are a consumer, merchant, issuer, business, or a public sector organization, you can have peace of mind knowing that your safety and security is our number one priority

Mastercard remains at the forefront of innovation and security to stay one step ahead of criminals and keep you safe.

There is no silver bullet to fight fraud, so we use multiple layers of security to protect every transaction

Not stated here

• The notice does not say how this priority is measured or what Mastercard owes anyone if a threat is not prevented.

Security & Safeguards · Company practice

Mastercard describes four layers of protection: prevent, identify, detect, experience

Mastercard says it operates at four layers to protect the payments system and its customers' businesses: Prevent (securing devices, data and networks across the industry), Identify (identity verification and authentication), Detect (monitoring transactions for fraud and cyber threats) and Experience (consumer experience, including $0 liability protection and replacing cards on file). Each layer is described in general terms.

Supporting quotations

We have implemented and operate at four layers to protect the payments system and our customer’s businesses:

Prevent: Securing devices, data and networks in a coordinated manner across the industry helps reduce the risk of fraud significantly.

Qualifications & exceptions

• The layers are framed as protecting the payments system and Mastercard's customers' businesses, not cardholders directly.

Use & Processing · Company practice

Mastercard offers identity verification and digital identity services

Under its Identify layer, Mastercard says it supports real-time identity verification on its customers' behalf to deliver near frictionless authentication, and offers personal digital identity services that both consumers and customers can use.

Supporting quotations

We support real-time, seamless identity verification on our customers’ behalf. We offer unique personal digital identity services that can be used by both consumers and customers.

Qualifications & exceptions

• Identity verification is described as done on Mastercard's customers' behalf.

Not stated here

• This passage does not say which services these are, which data they use, or whether a consumer must opt in.

Security & Safeguards · Company practice

Mastercard monitors transactions across its network to detect fraud and cyber threats

Mastercard says it uses its network and technologies to monitor transactions across the globe and identify transaction fraud, financial crime, crypto crime and cyber threats. It offers tools to financial institutions, merchants and other businesses, which it says include artificial intelligence tools that model and predict fraudulent scenarios, real-time fraud scoring at the point of sale, cryptocurrency intelligence and blockchain solutions, and cyber health analysis.

Supporting quotations

We leverage the power of our network and our technologies to monitor transactions across the globe and identify transaction fraud, financial crime, crypto crime, and cyber threats.

Our comprehensive suite of tools offered to financial institutions, merchants and other businesses can be tailored to their customer base and include everything from artificial intelligence tools designed to model and predict fraudulent scenarios, to real-time fraud scoring at the point of sale, cryptocurrency intelligence and blockchain solutions and cyber health analysis.

Qualifications & exceptions

• The tools are offered to financial institutions, merchants and other businesses and can be tailored to their customer base.

Not stated here

• This passage does not say which personal data the monitoring tools use.

Charges & Financial Obligations · Context

The notice mentions $0 liability protection but gives no terms for it

Under the Experience layer, Mastercard says its services include its global $0 liability protection. This notice does not state what the protection covers, which cards or transactions qualify, or how to claim it. For enquiries about your Mastercard card and your purchases, the notice directs you to your financial institution or merchant.

Supporting quotations

including our global $0 liability protection

For enquiries about your Mastercard card and your purchases, please contact your financial institution or merchant.

Not stated here

• What the $0 liability protection covers, which cards or transactions qualify and how to claim it are not stated in this notice.

Use & Processing · Company practice

Mastercard helps automatically replace cards on file when a new card is issued

Mastercard says it is building payment experiences that help its customers avoid payment declines when a consumer fails to tell a merchant about a replacement card, and that its cardholder lifecycle management helps automatically replace cards on file when a new card is issued.

Supporting quotations

avoid payment declines if a consumer fails to inform the merchant about a replacement card

Cardholder lifecycle management is also a critical component we offer, which helps to provide an easier way to automatically replace cards on file when a new card is issued.

Qualifications & exceptions

• Described as a service Mastercard offers to its customers.

Not stated here

• The notice does not say how a consumer can opt out of automatic replacement of cards on file, or what card data is passed to merchants to do it.

Legal Rights & Agreement Rules · Company practice

Mastercard acts as a processor for many fraud activities and a controller for others

For many of its fraud and security activities Mastercard says it acts as a data processor on behalf of and under the instructions of financial institutions and merchants. Mastercard International Incorporated and its affiliates say they process personal information as a data controller to protect you against fraud. The notice defines personal information as any information relating to an identified or identifiable individual.

Supporting quotations

For many of our fraud and security activities, we act as a data processor on behalf of and under the instructions of financial institutions and merchants.

process various types of Personal Information, as a data controller, to protect you against fraud.

If you are located in the EEA, UK or Switzerland, Mastercard Europe SA is the entity responsible for the processing of your Personal Information.

WE PROCESS PERSONAL INFORMATION FOR FRAUD PREVENTION AND MONITORING AND FOR PROVIDING CYBER SECURITY SOLUTIONS FOR OUR CUSTOMERS

Qualifications & exceptions

• If you are located in the EEA, UK or Switzerland, Mastercard Europe SA is the responsible entity.

Not stated here

• How financial institutions and merchants use data Mastercard processes on their behalf is not described in this passage.

Legal Rights & Agreement Rules · Context

The notice shows an effective date of 11/30/2022

The Fraud & Security Notice gives its effective date as 11/30/2022. Because the day is 30, this reads as month/day/year, November 30, 2022.

Supporting quotations

Fraud & Security Notice

Effective Date: 11/30/2022

Data Access & Collection · Company practice

Mastercard may process transaction and fraud-risk data about you

Mastercard lists transaction data, fraud and authentication risk scores, transaction risk factors, location data, merchant details, items purchased, information about disputed transactions and confirmed fraudulent activity among the personal information it may process.

Supporting quotations

This may include:

Transaction data, fraud and authentication risk scores, transaction risk factors, location data, merchant details, items purchased, information about disputed transactions and confirmed fraudulent activity.

Qualifications & exceptions

• Introduced as personal information the notice says 'may include', not as data collected about every person.

Data Access & Collection · Company practice

Mastercard may process blockchain and cryptocurrency transaction information

Mastercard lists certain information gathered from the blockchain, including blockchain address, other cryptocurrency transaction details and IP address, among the personal information it may process.

Supporting quotations

Certain information gathered from the blockchain, including blockchain address, other cryptocurrency transaction details and IP address.

Qualifications & exceptions

• Described as 'certain' information, within a list the notice says 'may include' these items.

Data Access & Collection · Company practice

Mastercard may collect device and interaction data through cookies and web beacons

Mastercard lists information collected by automated means such as cookies and web beacons among the personal information it may process, including IP address, browser type, operating system, mobile device unique identifier, geographical area, referring URLs and information on actions taken or interaction with its digital assets.

Supporting quotations

Certain information about you collected via automated means such as cookies and web beacons when you interact with our ads, mobile apps, or visit our websites, pages or other digital assets, such as IP address, browser type, operating system, mobile device unique identifier, geographical area, referring URLs and information on actions taken or interaction with our digital assets.

Qualifications & exceptions

• Collected when you interact with Mastercard's ads or mobile apps, or visit its websites, pages or other digital assets.

Not stated here

• This passage does not describe any choice to decline cookies or web beacons.

Data Access & Collection · Company practice

Some Mastercard products use behavioral data from your device interactions for fraud prevention

Mastercard says some of its online products and services include advanced fraud prevention technology that uses behavioral data based on your device interactions, such as face ID, fingerprints, keystroke timing, scroll position and mouse-location.

Supporting quotations

Some of our online products and services also include advanced fraud prevention technology using behavioral data based on your device interactions, such as face ID, fingerprints, keystroke timing, scroll position and mouse-location.

Qualifications & exceptions

• Applies to 'some' of Mastercard's online products and services, not all of them.

Not stated here

• The notice does not say which products and services use this behavioral data.
• The notice does not say how long behavioral data such as face ID or fingerprints is kept.

Data Access & Collection · Company practice

Mastercard may process publicly available data about sole proprietors and cryptocurrency companies

Mastercard lists publicly available data among the personal information it may process, described as including the information technology profile and assets of sole proprietors and cryptocurrency companies, such as domains, location data and cookies, contact details in public web pages or domain registration information, residential IP addresses in reputation lists, sanctions lists, and authorship of published intelligence about cyber security threats.

Supporting quotations

Publicly available data including information technology profile and assets of sole proprietors and cryptocurrency companies, such as domains, location data and cookies, contact details in public web pages or domain registration information, residential IP addresses in reputation lists, sanctions lists, and authorship of published intelligence about cyber security threats.

Qualifications & exceptions

• The data described concerns sole proprietors and cryptocurrency companies.

Data Access & Collection · Company practice

Mastercard may process identity verification data such as national identification number

Mastercard lists identity verification data among the personal information it may process, such as name, address, national identification number, mobile phone number, age and nationality.

Supporting quotations

This may include:

Identity verification data such as name, address, national identification number, mobile phone number, age, and nationality.

Qualifications & exceptions

• Listed as examples ('such as') within personal information the notice says 'may include' these items.

Data Access & Collection · Company practice

Mastercard may process fraud and risk data about sole proprietors, owners and cryptocurrency companies

Mastercard lists fraud and risk data of sole proprietor and principal owner merchants and cryptocurrency companies among the personal information it may process. It says this may include name and contact information of the companies' management personnel, and a fraud reason code.

Supporting quotations

Fraud and risk data of sole proprietor, principal owner merchants and cryptocurrency companies, which may include name and contact information of the companies’ management personnel, and fraud reason code.

Qualifications & exceptions

• Concerns sole proprietor and principal owner merchants and cryptocurrency companies.

Data Access & Collection · Company practice

Mastercard says it gets this information from institutions, merchants, you and third parties

Mastercard says it obtains the categories of personal information above from financial institutions and merchants, from your service providers, directly from you, from third parties as detailed below, or from your interaction with its digital assets.

Supporting quotations

We obtain the above categories of Personal Information from various sources: from financial institutions and merchants, from your service providers, directly from you, from third parties as detailed below or from your interaction with our digital assets.

Not stated here

• The notice does not say which category of information comes from which source.

Legal Rights & Agreement Rules · Company commitment

Mastercard says it processes only with a valid legal ground, and relies on consent in some countries

Mastercard says it processes personal information for the listed purposes only when it has a valid legal ground under applicable law, depending on the country where you are located. It adds that in some countries consent is the only or most appropriate legal basis, and there it relies on consent for all processing activities; this consent may be obtained for Mastercard by your financial institution, merchant, service provider or another partner.

Supporting quotations

We will only process your Personal Information for the below purposes when we have a valid legal ground for the processing in accordance with applicable law, depending on the country in which you are located.

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

In certain cases, this consent may be obtained from you on our behalf by your financial institution, merchant, service provider, or another partner.

Qualifications & exceptions

• The legal ground depends on the country where you are located.
• In certain cases consent may be obtained for Mastercard by your financial institution, merchant, service provider or another partner.

Not stated here

• The notice does not say which countries rely on consent or how consent given through a partner can be withdrawn.

Legal Rights & Agreement Rules · Restriction or exception

The chart covers Mastercard as controller; partners are responsible when Mastercard is a processor

The chart describes the processing activities for which Mastercard acts as a data controller. Where Mastercard acts as a data processor for financial institutions, merchants or other partners who are controllers, those partners are responsible for ensuring a valid legal ground, and the notice refers you to their privacy policies for how your personal information is processed.

Supporting quotations

The chart below describes the processing activities for which we act as a data controller.

Where we act as a data processor on behalf of financial institutions, merchants, or other partners who operate as data controllers, the financial institutions, merchants, or other partners are responsible for ensuring a valid legal ground for the data processing.

Please refer to their respective privacy policies for more information regarding the processing of your Personal Information.

For many of our fraud and security activities, we act as a data processor on behalf of and under the instructions of financial institutions and merchants.

Qualifications & exceptions

• Applies only to processing activities where Mastercard acts as controller; processor activities follow the partner's legal ground.

Not stated here

• Those partners' privacy policies are not part of this notice.

Legal Rights & Agreement Rules · Company practice

Protecting against fraud, cyber incidents and managing risk: four possible legal bases

Mastercard lists protecting you and others against fraud and cyber incidents, strengthening the cyber resilience of your operations, and managing risk exposure and franchise quality as a processing activity. The legal bases it lists are your consent, compliance with a legal or regulatory obligation, necessity for entering into or performing a contract to which you are a party, and a legitimate interest of Mastercard or a third party in preventing and protecting against fraud and securing its network and the payment transactions it processes.

Supporting quotations

Protect you and others against fraud, cyber incidents and strengthen the cyber resilience of your operations, and manage risk exposure and franchise quality.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of, a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of preventing and protecting against fraud, securing our network and the payment transactions that we process.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Monitoring and preventing fraud, unauthorized transactions and claims: four possible legal bases

Mastercard lists monitoring and preventing fraud, unauthorized transactions, claims and other liabilities on its payment network, and monitoring and preventing fraud on the blockchain in relation to cryptocurrency, as a processing activity. The legal bases it lists are your consent, compliance with a legal or regulatory obligation, necessity for a contract to which you are a party, and a legitimate interest of Mastercard or a third party in monitoring and preventing against fraud.

Supporting quotations

Monitor and prevent fraud, unauthorized transactions, claims and other liabilities on our payment network, as well as monitor and prevent fraud on the blockchain in relation to cryptocurrency.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of, a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of monitoring and preventing against fraud.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Authenticating you and verifying your identity: four possible legal bases

Mastercard lists authenticating you and verifying your identity as a processing activity. The legal bases it lists are your consent, compliance with a legal or regulatory obligation, necessity for a contract to which you are a party, and a legitimate interest of Mastercard or a third party in authenticating you and verifying your identity.

Supporting quotations

Authenticate you and verify your identity.

You consented to the use of your Personal Information; or

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

The processing is necessary for entering into, or performance of, a contract to which you are a party; or

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of authenticating you and verifying your identity.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Keeping payment networks secure: legal obligation or legitimate interest

Mastercard lists maintaining the integrity and security of its payment networks as a processing activity. The only legal bases it lists are compliance with a legal or regulatory obligation, and a legitimate interest of Mastercard or a third party in maintaining that integrity and security.

Supporting quotations

Maintain the integrity and security of our payment networks.

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

We, or a third party, have a legitimate interest in using your Personal Information for maintaining the integrity and security of our payment networks.

Legal Basis for Processing (where required under applicable law)

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.
• The chart lists no consent basis for this activity, but the notice says that in countries where consent is the only or most appropriate basis Mastercard relies on consent for all processing activities.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Complying with legal obligations, including anti-money laundering: legal obligation or legitimate interest

Mastercard lists complying with legal obligations, including under applicable anti money laundering legislation, as a processing activity. The only legal bases it lists are compliance with a legal or regulatory obligation, and a legitimate interest of Mastercard or a third party in using personal information for compliance with legal obligations.

Supporting quotations

Comply with legal obligations, including under applicable anti money laundering legislation.

The processing is necessary for compliance with a legal obligation or other regulatory obligations; or

We, or a third party, have a legitimate interest in using your Personal Information for compliance with legal obligations.

Legal Basis for Processing (where required under applicable law)

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.
• The chart lists no consent basis for this activity, but the notice says that in countries where consent is the only or most appropriate basis Mastercard relies on consent for all processing activities.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Legal Rights & Agreement Rules · Company practice

Internal research and development on fraud detection: legitimate interest only

Mastercard lists conducting internal research and development to evaluate and enhance its fraud detection, prevention, monitoring and cyber resilience operations and products as a processing activity. The only legal basis it lists is a legitimate interest of Mastercard or a third party in using personal information for internal research and development aimed at preventing and protecting against fraud, securing its network and the payment transactions it processes.

Supporting quotations

Conduct internal research and development which aim at evaluating and enhancing our fraud detection, prevention, monitoring and cyber resilience operations and products.

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of conducting internal research and development with the aim of preventing and protecting against fraud, securing our network and the payment transactions that we process.

Legal Basis for Processing (where required under applicable law)

in some countries consent is the only or most appropriate legal basis for the processing of Personal Information, and in those countries we rely on consent for all processing activities.

Qualifications & exceptions

• The chart lists these legal bases 'where required under applicable law', as alternatives joined by 'or'.
• The chart lists no consent basis for this activity, but the notice says that in countries where consent is the only or most appropriate basis Mastercard relies on consent for all processing activities.

Not stated here

• The notice does not say which listed basis applies to which person or country.

Inference & Profiling · Company practice

Mastercard aggregates personal information to build fraud and money laundering models

Mastercard lists aggregating some of your personal information to create rules-based or artificial intelligence models that identify past and potential future fraud or money laundering patterns. It says it offers the resulting advanced fraud prevention, anti money laundering and security features to financial institutions, merchants, customers and partners, and uses machine learning to analyze and identify fraudulent or illegal transactions.

Supporting quotations

Aggregate some of your Personal Information to create rules-based or artificial intelligence models to identify past and potential future fraud or money laundering patterns to offer advanced fraud prevention, AML and security features to financial institutions, merchants, customers and partners.

We use machine learning to analyze and identify fraudulent or illegal transactions.

Legal Basis for Processing (where required under applicable law)

Qualifications & exceptions

• Applies to 'some' of your personal information, in aggregated form.
• The features built from the models are offered to financial institutions, merchants, customers and partners.

Not stated here

• The notice does not say which personal information is aggregated.

Charges & Financial Obligations · Company practice

Fraud models may lead your institution or merchant to decide whether to verify your identity or authorize a payment

Mastercard says the use of its models may lead your financial institution, merchant or service provider to make decisions whether or not to verify your identity or authorize your payment.

Supporting quotations

The use of these models may lead your financial institution, merchant or service provider to make decisions whether or not to verify your identity or authorize your payment.

Qualifications & exceptions

• The decision is described as made by your financial institution, merchant or service provider, following use of the models.

Not stated here

• The notice does not say how a person can contest or ask for review of such a decision.

Legal Rights & Agreement Rules · Company practice

The legal basis listed for building fraud models is a legitimate interest

For aggregating personal information and creating models to identify and prevent fraud, Mastercard lists only one legal basis: a legitimate interest of Mastercard or a third party in aggregating personal information and creating models to identify, prevent and protect its customers and the payment ecosystem against fraud. The chart row lists no consent, legal obligation or contract basis for this activity.

Supporting quotations

We, or a third party, have a legitimate interest in using your Personal Information for the purpose of aggregating Personal Information and creating models to identify, prevent and protect our customers and the payment ecosystem against fraud.

Aggregate some of your Personal Information to create rules-based or artificial intelligence models to identify past and potential future fraud or money laundering patterns

Qualifications & exceptions

• Listed 'where required under applicable law'; the notice also says that in countries where consent is the only or most appropriate basis it relies on consent for all processing activities.

Not stated here

• The notice does not say which country's law makes this basis apply.

Sharing & Disclosure · Company practice

Mastercard may share your data with a listed range of third parties

Mastercard says it may share your data with third parties including financial institutions, identity verification service providers, fraud data service providers, government entities, utilities, public records, credit bureaus, property files, telecommunications operators, watch lists and geo-visualization service providers. It says it ensures your personal information is only used for the above purposes, subject to strict data protection and security obligations in its contracts with those third parties.

Supporting quotations

We may share your data with third parties including financial institutions, identity verification service providers, fraud data service providers, government entities, utilities, public records, credit bureaus, property files, telecommunications operators, watch lists, geo-visualization service providers.

We ensure that your Personal Information is only used for the above purposes subject to strict data protection and security obligations through our contracts with such third parties.

For many of our fraud and security activities, we act as a data processor on behalf of and under the instructions of financial institutions and merchants.

Qualifications & exceptions

• Stated as 'may share' with third parties 'including' those listed, so the list is not described as complete.
• Use is limited to 'the above purposes' by contracts with the third parties.

Not stated here

• The notice does not say which categories of data are shared with which recipients.
• Items such as public records, property files and watch lists are listed among the third parties; the notice does not say whether they are recipients or sources of data.
• The 'strict data protection and security obligations' are not described.
• The notice does not say whether this sharing statement covers data Mastercard handles as a processor under the instructions of financial institutions and merchants.

Legal Rights & Agreement Rules · User right or choice

Your rights and choices are in the Global Privacy Notice and can be exercised by email

The notice says you have certain rights and choices regarding the personal information Mastercard maintains about you. For those rights, and for how Mastercard shares, transfers, retains or protects personal information, it points you to its Global Privacy Notice. You, or a party authorized to act on your behalf, can exercise the rights detailed there by emailing privacyanddataprotection@mastercard.com.

Supporting quotations

You have certain rights and choices regarding the Personal Information we maintain about you.

For more information about your rights, to contact us, or to learn more about how we share, transfer, retain or protect your Personal Information, please read our Global Privacy Notice.

You, or a party authorized to act on your behalf, can exercise your rights that are detailed in the Global Privacy Notice by emailing us at: privacyanddataprotection@mastercard.com.

Qualifications & exceptions

• Applies to the rights detailed in the Global Privacy Notice; a party authorized to act on your behalf may also exercise them.

Not stated here

• This notice does not list the rights, response times, identity checks or retention periods; it refers to the Global Privacy Notice, which was not supplied here.

Legal Rights & Agreement Rules · Context

This notice adds detail to the Global Privacy Notice; some products have their own notices

The notice says it provides further information about certain aspects of the processing of personal information covered by the Global Privacy Notice. It adds that some of the security and fraud prevention and monitoring solutions mentioned above may have their own specific privacy notices, which you are asked to consult.

Supporting quotations

This Fraud and Security Notice provides further information about certain aspects of the processing of Personal Information covered by our Global Privacy Notice.

Some of the security and fraud prevention and monitoring solutions mentioned above may have their specific privacy notices. Please consult them for more information.

Qualifications & exceptions

• Covers certain aspects of processing, not all of Mastercard's processing.

Not stated here

• The Global Privacy Notice and any product-specific notices were not supplied with this document.