Since we are not a direct customer of Mastercard their customer service told me i could register at the following website and directed me to a pdf regarding the wording:

https://marketingcenter.mastercard.com/portal/registration/login.aspx?ReturnUrl=%2fportal%2flogout

On the main page of the website one of the "whats new" advertisements refers to the zero liability. They have a pdf you can print that has the wording. I assume this is what they will use...

The 2 pg document includes info on ID Theft Resolution Services and Zero Liability Protection

Here's a copy of the Zero Liability Protection:

Zero Liability Protection

Have peace of mind knowing that the bank that issued your MasterCard [consumer or small
business card] will not hold you responsible for unauthorized transactions. Zero liability
applies to all transactions made in the store, over the telephone or online. As a cardholder,
you will not be held responsible for unauthorized transactions if:

• you have exercised reasonable care in safeguarding your card from loss or theft and
you promptly reported any loss or theft of your card to your issuer
• (Prepaid only) Your card is registered in your name


If these conditions are not met and you suspect that you have an unauthorized transaction
on your MasterCard, contact your bank as other protections may apply.

For more information, please visit http://www.mastercard.us/zero-liability.html

............................................................

It also follows with:


Alternate (approved and on Marketing Center already):

With [Card Name] MasterCard,® you can shop with confidence knowing you’re protected.

Because your card comes with zero liability,* you’re not liable for unauthorized purchases.
Period. Shop anywhere—online, in stores, [and with MasterPass™]— knowing that we have
measures in place to help make sure you’re protected from unauthorized purchases.

And with Identity Theft Resolution Services you have access to a host of resources should
your card ever be compromised.

Shop with confidence.

Anywhere. Anytime.

* Does not apply to certain prepaid cards, or corporate cards. Certain conditions and
restrictions apply. Please see www.mastercard.us/zero-liability.html for more details.
.............................................................

The exact verbiage from MasterCard's U.S. Operations Bulletin dated May 27, 2014.

"MasterCard is revising its “zero liability” rule in the U.S. region by simplifying the language and applying the rule to all MasterCard® branded POS and ATM transactions."

An Issuer must not hold a Cardholder liable for a Transaction that was not authorized by the Cardholder if the Cardholder exercised reasonable care in safeguarding the Card from risk of loss or theft and, upon becoming aware of such loss or theft, promptly reported the loss or theft to the Issuer.

This Rule shall not apply to a Transaction conducted with a Card that is:
a. issued to an entity other than a natural person;
b. issued for a commercial purpose; provided, the Rule shall apply to a Transaction conducted with Card for a “small business” program as described on www.mastercardbusiness.com (under “Small Business,” select the “Products” tab);
c. issued and/or sold to a person until such time as that person’s identity is registered by or on behalf of the Issuer in connection with such issuance and/or sale, which registration may include customer identification program requirements.

On the surface I can see how one could interpret this as being all transactions regardless of network since the rule does not specify, but we have to look to the definition of ATM Transaction in MasterCard Rules.

ATM Transaction
A cash withdrawal effected at an ATM Terminal with a Card and processed through the MasterCard ATM Network. An ATM Transaction is identified with MCC 6011 (Automated Cash
Disbursements—Customer Financial Institution).

I agree with John. MasterCard branded networks would be MasterCard, Maestro, & Cirrus. I don't see how this could extend to transactions processed using competing networks. That being said, I also wouldn't want to get hit with non-Compliance fines from MasterCard. Sounds like a good questions for the attorneys.

I think part of the confusion also comes with attempts to simplify or interpret the rule. Email we received from Account Executive - North America Region with the announcement and comments. I am asking for clarification as a result of this thread. The announcement included the following comments:

A few additional summary notes on these changes:
Please note that the expanded Zero Liability Rule:
1. Requires Issuers to cover all transactions on MasterCard branded cards including those routed to a competing PIN
Network.
2. Does NOT require Issuers to cover Maestro or Cirrus transactions on Visa branded cards

Just noted in the front of the manual under "Applicability of Rules in the Manual" are the following statements which seem to conflict with the definitions we are gathering. Conflict?

This manual contains Rules for the MasterCard, Maestro and Cirrus brands. The Rules relate to Activity conducted pursuant to a License that MasterCard grants to a Customer for use of one or more of these brands.

Rules relating to...
ATM Transactions

Apply to...
A Transaction conducted with a MasterCard, Maestro, or Cirrus Card at an ATM Terminal and routed to the Interchange System."

Rules relating to...
MasterCard POS Transactions

Apply to...
A POS Transaction conducted with a MasterCard Card.

I'm not one to tell MasterCard how to operate its business, but this is really beginning to sound like a public relations SNAFU. Press releases say one thing (or fail to define terms) and the operations bulletins say another. Spokespersons put yet another spin on the issue.

It's time for MasterCard to clear the air on these questions by issuing an FAQ or other document that clearly defines the reach of the Zero Liability rule in terms that all stakeholders can understand.

Diddo.

Although clarification still pending on the card or network discussion, the following was received from MasterCard which may help with other issues identified on the thread:

We are taking the position that a cardholder is eligible for zero liability if the cardholder does 2 things:
1. Acts reasonably to protect the card; and
2. Reports any unauthorized use promptly.

If the Issuer determines that the cardholder did not do these things – meet these requirements – then the Issuer can impose liability up to the maximum amount allowed by law. Under our rule the Issuer will need to determine if a notice is prompt. The Issuer can chose to define this in the terms and conditions or on a case by case basis dependent upon local laws.

In the case of a debit card the maximum liability under the law (Reg E) is $50 if the unauthorized use is reported within 2 days or $500 if it is not report in 2 days. However, If the consumer exercised reasonable care and the loss is reported within 2 days that would certainly meet the “prompt” notification requirement under our rule and therefore the consumer would enjoy zero liability.

If the unauthorized use is reported after 2 days but within the period of time defined by the issuer to be prompt (we left that open for the Issuer to define) then the consumer will enjoy zero liability. If the loss is reported beyond the window of time defined by the Issuer or local laws to be “prompt” then the maximum liability will be $500.

So, as a practical matter, on a debit card, the consumer will enjoy zero liability provided the consumer exercises reasonable card and promptly reports unauthorized use, unless the unauthorized use is reported after the time frame that the issuer defines as prompt. In the latter case maximum liability is $500.

MasterCard response to card or network:

Hi Michael,
We are taking the position that the rule applies whenever the MasterCard brand is on the front of card, regardless of the network that the transaction is switched. Consumers, seeing this as a MasterCard card, would expect the protection to apply. In the instance of Maestro on a Visa card, the consumer would view it as a Visa card, and we are ok with the Visa rules applying.

And you know, from a consumer point of view, I agree with that response. I don't pay attention to what network my transaction is being processed on (if I even have a way of knowing).

Would someone be willing to share exactly what the statement message should say?

I know it's not required under Reg E; but is anyone sending change notices to business customers who fit MasterCard's criteria of a small business as well?

Our bank issues debit cards with the Visa logo. For international transactions that are processed through the Cirrus network, a cross border fee is charged. We currently do not pass that charge on to the customers but are considering doing so in the future. Would we be required to provide a change notice?

Since you are adding a fee in connection with an electronic funds transfer, yes you would need to provide 21 days advance notice to your cardholders before you begin charging.

Thank you!

so - here is what I am getting:
For our mastercard debit cards we need to send out a change in terms 21 days before October 15, 2014 to all consumer and small business program customers (but not to commercial purpose customers ).

we also have a credit card product through mastercard, but that is not the subject of these new rules.

am I close?

We sent the change notice to our small business customers as well.

The ABA released a staff analysis of the MC changes, stating notice requirements will vary depending on the liability policy changes banks choose to implement. It does not provide sample language for those choosing to increase consumer liability to align with Reg E, but I've found many examples online.

Any suggestions on how to condense the statement message to 250 characters? That is my limit for the statement message.

Would this mean that we have to notify them within the 21 day requirement for Reg E even though it is not adverse?

It's not an adverse change to fees, liability, types of available EFTs or limits on the frequency or $ amount of transfers. It doesn't require an advanced 21 day change in terms.

I'm pouring through our cardholder agreements and our Reg E disclosures today, and if there is any info on zero liability in them, we'll update them by the 17th.

It could be construed as an adverse change to consumer liability, since one aspect of the change is to add the requirement for "prompt" notification as a condition for zero liability for unauthorized transactions.

Removing MasterCard's $50 liability cap on POS purchases would also be an adverse change.

I am still wrestling with imposing the $500 vs $50 liability in cases involving the use counterfeit cards (by far our largest category of errors). Reg E only requires them to report the loss/theft/error within 2 business days of LEARNING of it, not of it actually happening. So if the customer reports the error 20 days after it occured, but said they JUST learned of it today, we can only impose the $50 liability, right? The only time we could enforce the $500 is if they voluntarily told us they actually noticed the error, say last week, but was too busy to report it within 2 business days of noticing it??

It seems we are stuck enforcing a rule that pre-dates the reality of how most fraudulent transactions occur today (i.e. with the card still in the cardholder's possession and not lost/stolen).

How is someone making a counterfeit card and running unauthorized transactions on an account related to the liability provisions involving the loss/theft of someone's card??