MasterCard has announced several changes to its Account Data Compromise program, increasing and accelerating reimbursements for costs incurred by card issuers after data breaches. The move follows aggressive ABA advocacy with the card networks to secure higher reimbursements — particularly for community banks, which typically have greater costs than large-volume issuers.
Starting on Jan. 1, 2016, MasterCard issuers will be able to opt-in to the newly structured ADC program. By opting into the higher-reimbursement ADC program each year, issuers will agree not to sue MasterCard or acquirers for breaches taking place that year. Issuers that opt out may attempt to seek reimbursement for breach-related losses directly from the merchants.
After an eligible breach — one affecting at least 30,000 MasterCard accounts — issuers will receive higher reimbursement rates for the cards they reissue. Issuers with less than $200 million in annual MasterCard purchase volume, will qualify to receive $6.25 per magnetic stripe card. Issuers with $200 million to $1 billion in volume will receive $4 per mag stripe card, and the biggest issuers, with more than $1 billion in volume, will receive $2.70 per mag stripe card.
Issuers will also be reimbursed an additional $1.00 (or $1.05 for issuers with over $1 billion in volume) for every chip card they reissue. Starting on June 1, 2016, MasterCard will no longer provide any reimbursement to issuers for operational costs or fraud losses on mag stripe-only cards.
As retailer data breaches, including those at Home Depot and Target, have become more frequent and more damaging, banks have responded proactively by reissuing cards — preventing millions of dollars in fraud losses. An ABA survey last year that was shared with the card networks found that smaller banks pay significantly more to reissue.
