Maestro Global Rules (PDF) - MasterCard

Europe Region
8.4 PIN and Key Management Security Requirements
If the Transaction is processed via a different network or processing
arrangement than the Interchange System (including bilateral and on-us
processing), the Acquirer must ensure that corresponding data elements contain
values that allow issuers to clearly identify the Transaction as a Maestro PayPass
Transaction.
Regardless of processing arrangement, all Customers using the PayPass
technology must have been granted the appropriate PayPass licenses as
required in Chapter 21 of this rulebook.
8.4 PIN and Key Management Security Requirements
8.4.1 PIN Verification
In addition to the Rules in Chapter 8, “Security,” Rule 8.4.1 in part 1 of this
rulebook, the following apply:
Refer to the Authorization Manual, Chapter 12, “PIN Processing for Europe
Region Customers” for information about PIN validation by the Dual Message
System in the Europe region.
8.4.2 Stand-In Authorization
If authorization is done by the Dual Message System on behalf of the Issuer,
the identification of the Cardholder is based on a cryptographic transformation
performed in the MasterCard Host Security Module of data encoded on ISO
track 2 in combination with the PIN entered by the Cardholder. The algorithm
produces a PIN Verification Value (PVV) that is to be compared with the value
obtained from the Card. Positive identification is achieved if both values are
identical.
To verify a PIN, the following Card data must be present:
1. PAN; and
2. expiration year and month.
8.9 Account Data Compromise Events
8.9.4 Corporation Determination of ADC Event or Potential
ADC Event
8.9.4.2 Potential Reduction of Financial Responsibility
In addition to the Rules in Chapter 8, “Security,” Rule 8.9.4.2 in part 1 of this
rulebook, the following applies:
©1993–2012 MasterCard. Proprietary. All rights reserved.
17-48 9 November 2012 • Maestro Global Rules