Today I was asked, again, to present additional proof of identification when purchasing an item with a MasterCard. I had read this was a breach of contract between MasterCard and the merchant, but I hadn't read the primary source so I wasn't 100% sure. So I did.
MasterCard's Merchant Rules are available
here. From the "Bylaws and Rules" on page 45:
9.11.2 Cardholder Identification
A merchant must not refuse to complete a MasterCard card transaction solely because a cardholder who has complied with the conditions for presentment of a card at the POI refuses to provide additional identification information, except as specifically permitted or required by the Standards. A merchant may require additional identification from the cardholder if the information is required to complete the transaction, such as for shipping purposes. A merchant in a country or region that supports use of the MasterCard Address Verification Service (AVS) may require the cardholder’s ZIP or postal code to complete a cardholder-activated terminal (CAT) transaction, or the cardholder’s address and ZIP or postal code to complete a mail order, phone order, or ecommerce transaction.
Such exceptions, I found, are detailed in the "Chargeback Guide" in sections 2.1.1.2 and 2.1.1.3. Official government documents can be requested for "unique transactions processed in a face-to-face environment" (pg 61) or "if the card is not signed" (pg 62).
Visa has almost identical rules which may be found
here (PDF).
When should you ask a cardholder for an official government ID? In most cases, merchants may not ask for an ID as part of their regular card acceptance procedures, either when a valid card is first presented or to complete a sale. (pg 34)
And what are those exceptions? Only if the card is unsigned (pg 34) or if the signature on the receipt doesn't match the signature on the card (pg 80) (Ha!
As if they ever look!)
Basically it's only a breach of contract to
refuse a sale if the requested ID is not shown, not to actually request the ID.
In other words, the whole "requiring additional ID to protect against identity theft" is, like most public security measures, really just a charade, since people who steal credit cards for a living presumably know this rule.
Thus concludes this episode of spontaneous research.