Maestro Global Rules (PDF) - MasterCard

Issuing
6.8 Mobile Remote Payment Transactions
(19) digits in length. The PAN must start with a BIN. (The BIN can be the
one that is currently used by the Issuer). The Issuer may optionally use
a pseudo PAN, (a PAN that is different from the PAN displayed on the
Cardholder’s physical card). If a pseudo PAN is used, it must be static;
2. Complete the expiration date field. This four (4)-digit field may be used for
the actual expiration date of the Card, which must not exceed five (5) years.
The format of the field is as follows:
a. the first two (2) digits must be a value between 01 and 12; and
b. value of the next two (2) digits must not be equivalent to more than five
(5) years after the Transaction year;
3. Comply with the branding requirements in the Mobile Remote Payments
Program Guide,
4. Ensure that its authorization system provides a valid response code as
identified in the authorization message. “Call Me” is not a permitted
response. Mobile Remote Payment Transactions may be approved or
declined only; and
5. Implement security techniques between the Cardholder Mobile Device for
Personal PIN Entry and the Issuer server to guard against unauthorized
Transactions. In addition, Issuers must provide implementation, registration,
and instructions for Cardholders or delegate a specific implementation and
registration function to a Service Provider. Refer to the Mobile Remote
Payments Program Guide for additional information.
Issuers may choose to implement mobile specific credentials and a method of
generating an Accountholder Authentication Value (AAV), as an alternative to
using PIN as the CVM for Issuer Domain Mobile Remote Payment Transactions.
If an Issuer chooses to implement this method, it must provide clear
communication to the Cardholder regarding the process to conduct an Issuer
Domain Mobile Remote Payment Transaction without the use of PIN as the CVM.
Refer to the Mobile Remote Payments Program Guide for additional information.
6.8.3 Issuer Responsibilities: Acquirer Domain Mobile Remote
Payment Transactions
Issuers must recognize properly identified Acquirer Domain Mobile Remote
Payment Transactions. If an Acquirer Domain Mobile Remote Payment
Transaction is reported as a fraudulent Transaction, and the Remote Payments
Program Type has a value of 2 (Acquirer Domain) was present in Data Element
48, subelement 48, subfield 1 (Mobile Program Indicators), Issuers will have a
chargeback right.
©1993–2012 MasterCard. Proprietary. All rights reserved.
Maestro Global Rules • 9 November 2012 6-17