Maestro Global Rules (PDF) - MasterCard

Europe Region
8.13 Signature-based Transactions
8. A PCI SSC Forensic Investigator (PFI) has validated that the Merchant
was compliant with milestones one through four of the PCI DSS Prioritized
Approach at the time of the ADC Event or Potential ADC Event.
8.13 Signature-based Transactions
8.13.1 Introduction
Cardholder verification is performed using a signature, which must be verified
by the Merchant. For refund Transactions, the receipt must be signed by the
Merchant rather than the Cardholder.
8.13.2 Certification
The security certification report must indicate which cryptographic techniques
are used to obtain security services such as entity authentication, data
confidentiality or protection against unauthorized modification, deletion or
injection of messages.
The general security requirements for secure cryptographic devices, key
management and operational procedures listed in the section entitled “PIN and
Key Security Requirements,” in Chapter 8 in part 1 and in this Chapter 17 in
part 2 of this rulebook apply.
8.13.3 Signature-based POS Terminals
Signature-based POS Terminals must comply with the following requirements:
1. if the signature is unsatisfactory, the Merchant must be able to indicate the
cancellation of the Transaction to the POS Terminal, or perform a refund;
2. in case of temporary printer malfunction, the POS Terminal should be able
to reprint the receipt, preferably including a duplicate statement, without
repeating the Transaction process;
3. the POS Terminal must be designed to protect the Cardholder from
deception with regard to:
a. the fact that no PIN is required;
b. the normal sequence of Transaction steps;
c. the information printed or displayed;
d. additional data requested;
e. the authorization response;
f. the completion or cancellation of the Transaction.
©1993–2012 MasterCard. Proprietary. All rights reserved.
Maestro Global Rules • 9 November 2012 17-49