Controls the A/OPC time burden for the mandatory suspension-and-notification workflow. GSA Purchase Card Policy OAS 4200.1C requires the A/OPC to authenticate suspicious activity, contact the cardholder, suspend the account, and initiate bank contact before a replacement card is issued. Range: 1 hr (automated alert, simple case) to 6 hrs (complex case, multiple vendors, OIG consultation). Default 3 hrs reflects a moderate, well-documented compromise event.

Time the cardholder spends contacting the bank, confirming fraudulent transactions, activating the new card, and updating card-on-file credentials. Auriemma Consulting (2017) found 44% of reissued cards are linked to recurring payments requiring update. Range: 0.5 hr (low-volume cardholder, no recurring payments) to 4 hrs (high-volume buyer with many recurring vendor setups). Default: 2 hrs.

Sets the federal pay grade used to calculate fully loaded cardholder and A/OPC labor rates. OPM 2025 GS pay tables (Rest-of-US locality) plus OMB fringe rate of 36.25% and estimated overhead of 45% are applied. GS-7 base ~$47K; GS-9 ~$59K; GS-11 ~$72K; GS-13 ~$98K. Loaded hourly rates approximate $47, $60, $74, and $110 respectively. Adjust upward for management-heavy programs (DoD, DHS) or downward for administrative cardholder pools.

Direct cost to the issuing bank (Citibank or U.S. Bank) for physical card production, EMV chip personalization, secure mailing, and account system update. American Banker / Auriemma Consulting (2017) established the industry range as $3–$25. The low end reflects bulk issuance economics; the high end reflects expedited delivery or premium card stock. Standard government reissuance with 48-hr processing falls in the $10–$18 range. Default: $14.

The proportion of compromised cards that result in actual fraudulent transactions. FIS / Payments Leader (2018) establishes 5–10% as the industry range. The ABA Target Breach Impact Survey found only 2–3% of cards saw fraud at time of reissuance. Government purchase cards may have higher or lower rates depending on compromise vector: skimming events at vendors tend toward the lower end; targeted account takeover toward the higher end. Applied to the average fraud loss per card ($530, ABA). Default: 8%.

Number of pending or in-flight vendor transactions disrupted when the card is suspended for the 48-hr reissuance window (GSA Troubleshooting Guide). Derived from the program-level transaction rate of ~5.4/week: a 48-hr window spans roughly 1.5 business days, suggesting 1–2 new transactions may be attempted, plus any recurring charges scheduled during that period. Range: 1 (infrequent buyer) to 12 (daily operational buyer with multiple recurring contracts). Default: 4, reflecting a mid-volume cardholder with some recurring vendor relationships.

Time a vendor's accounts receivable staff member spends contacting the cardholder after a card decline — identifying the failure, locating contact information, placing the call, explaining the decline, and recording the new card details. Billtrust (2025) documents this as a standard manual AR workflow. Range: 10 min (automated decline notification with self-serve portal) to 45 min (manual process, multiple call attempts, voicemail). Default: 20 min reflects a typical government contractor AR workflow without automation.

The probability that a given compromised card event results in an OIG or Office of Special Investigations referral, triggering additional senior-grade labor. GSA SmartPay training (Lessons 7 & 12) mandates OIG referral for suspected fraud. In practice, many external compromise events (skimming, data breach) are closed administratively without formal OIG referral once the card is replaced and no confirmed fraud is found. No public data exists on the actual government-wide referral rate per compromised card event. This is an assumption. Range: 0% (treat all events as administrative) to 60% (strict referral culture). Default: 30%.

Number of days a vendor holds or delays shipment/service fulfillment while awaiting a valid replacement card. This creates working capital costs for the vendor (inventory held, cash not collected) and procurement delay costs for the agency. Ramp (2025) documents vendors holding shipments pending valid card credentials as standard practice. GoAutonomous (2026) found disputed invoices extend to an average 75-day receivable from 30-day terms. Range: 0 (vendor ships on account, collects later) to 7 days (high-security supplier, no ship-without-payment policy). Default: 2 days.