When cardholder data may have been stolen, the card schemes' clocks start at suspicion, not at confirmation, and a merchant that misses them pays for it in investigation costs, non-compliance assessments and a harder path back to normal trading. This playbook template covers any suspected compromise of payment card data at [Organisation], whether through point-of-sale malware, a database or file share holding card numbers, a compromised service provider or an e-commerce channel. It focuses on what other playbooks do not: working with the acquirer, engaging and managing a PCI Forensic Investigator (PFI), the notification duties and deadlines published by Visa, Mastercard and American Express, and what the merchant must do afterwards. It is for incident leads, payments and finance teams, legal counsel and the executives who will sign the contracts. For skimming scripts on checkout pages, use the Web Skimming Incident Playbook alongside this one.
How to use this template
- Adopt it as the card data annex to [Organisation]'s incident response plan, which PCI DSS Requirement 12.10.1 requires to exist and be ready to activate. See the Incident Response Plan Template.
- Get your acquirer's procedure in writing now. The scheme rules bind acquirers, and acquirers pass them to merchants through the merchant agreement. Your acquirer's contact, form and deadlines override anything general in this template.
- Re-check the scheme documents yearly. Deadlines and fees below were taken from Visa's What To Do If Compromised version 10.0 (effective 25 June 2026), Mastercard's Account Data Compromise Event Management Best Practices (26 February 2019) and the American Express Data Security Operating Policy (October 2026), as checked on 11 November 2026. They change.
- Replace every [placeholder] and test the playbook in a tabletop with payments, legal, IT and communications. Internal deadlines marked "NHI Mgmt Group recommendation" are suggestions, not scheme rules.
1. Scope and triggers
1.1 This playbook applies to any event that results, or could result, in unauthorised access to or disclosure of payment card account data (primary account number with or without cardholder name, expiry date, service code, or any sensitive authentication data) held, processed or transmitted by [Organisation] or by a service provider on its behalf. Mastercard's term for this is an Account Data Compromise (ADC) event; Visa and American Express use similar definitions.
1.2 Triggers include:
- External notice: the acquirer, a card scheme or law enforcement names [Organisation] as a common point of purchase for fraud.
- Internal detection: malware or memory-scraping tools on POS terminals or servers, unexpected outbound traffic from the cardholder data environment, attacker access to a database or backup containing card numbers.
- Unexpected PAN: card numbers found in logs, tickets, file shares or code where they should not be. PCI DSS Requirement 12.10.7 requires incident procedures to start when stored PAN is found anywhere unexpected.
- Service provider notice: a payment gateway, POS reseller or hosting provider reports a compromise affecting [Organisation]'s card data.
1.3 The playbook is activated on reasonable suspicion. Do not wait for proof: Visa's three-day reporting clock runs from evidence that raises reasonable suspicion of a compromise.
2. Roles and contacts
| Role | Named lead | Responsibilities in a card compromise |
|---|---|---|
| Incident lead | [Name, phone] | Declares the incident, owns the decision log and the scheme deadline tracker |
| Payments lead | [Name] | Single point of contact with the acquirer; supplies transaction data; tracks at-risk account uploads |
| Legal counsel | [Name or firm] | Engages the PFI where privilege strategy requires; reviews merchant agreement liability; data protection notices |
| PCI Forensic Investigator | [Firm, lead investigator] | Independent forensic investigation; reports directly to the schemes |
| IT and security operations | [Names] | Isolation without destroying evidence; log preservation; support to the PFI |
| Identity and cloud administrators | [Names] | Revoke credentials used in the intrusion, including service accounts and vendor remote access |
| Finance | [Name] | Budget for PFI, assessments and fees; insurance notification |
| Communications and customer service | [Names] | Holding statements, customer notices, store and call centre scripts |
2.1 Contacts to hold on this page: acquirer security or risk team [contact], payment gateway [contact], cyber insurer and its breach line [contact], retained PFI [firm, retainer reference], data protection authority [contact], law enforcement [contact].
3. Detection and triage
3.1 Within [2] hours of a trigger (NHI Mgmt Group recommendation), the incident lead, payments lead and legal counsel meet to decide: is there reasonable suspicion that card data was accessed? Record the time and the evidence. That time is your starting point for every scheme clock.
3.2 Identify the channel and systems: card-present (POS terminals, store servers, back-office PCs), card-not-present (web servers, payment APIs, call centre systems), stored data (databases, backups, data warehouse), or a service provider.
3.3 Estimate the window of exposure from the earliest evidence of attacker access to the cardholder data environment until containment. The PFI will refine it, but the schemes ask for at-risk accounts as soon as a window is determined.
3.4 Estimate the number of unique cards processed or stored in that window, by scheme. The number drives obligations: American Express, for example, requires a PFI for incidents involving 10,000 or more unique card numbers and a summary report below that.
3.5 Check for PIN or sensitive authentication data: full track data, card verification codes or PIN blocks in scope raise the severity and can bring PCI PIN Security requirements into the remediation.
4. Evidence preservation and containment
4.1 Visa's guidance is explicit about what not to do on compromised systems:
| Do not | Instead |
|---|---|
| Log on to compromised systems, change their passwords or use administrative credentials on them | Leave access to the PFI or your forensic team; change credentials from clean systems |
| Turn off, restart or reboot compromised systems | Keep them powered so volatile memory is preserved |
| Keep processing payments on compromised systems or connecting them to payment systems | Switch to standalone terminals, a hosted payment page or a clean fallback |
| Leave them connected | Disconnect from the internet and isolate from the network, for example by unplugging network cables |
| Rely on memory for the timeline | Retain all logs and evidence and record every action with a timestamp, preferably in UTC |
4.2 Place a preservation hold on firewall, proxy, DNS, POS application, database audit, identity provider and cloud logs covering at least [12] months before the trigger (NHI Mgmt Group recommendation; PCI DSS Requirement 10 already requires 12 months of audit log history). Stop any automated log or backup rotation that would delete them.
4.3 Revoke the attacker's access route from clean systems: vendor remote access tools, shared POS support accounts, service account passwords, API keys for payment gateways and cloud access keys. Many card compromises start with a reused or shared remote support credential. See the Payment Service Provider NHI and Key Security Guide.
4.4 Decision (incident lead, payments lead, business owner): keep trading on an alternative channel, or stop taking cards in the affected channel. Do not restore a compromised system to production before the PFI agrees containment.
5. Acquirer and scheme notification
5.1 Notify the acquirer immediately. Visa lists the acquiring bank among the parties to notify immediately, and many acquirers notify the schemes on the merchant's behalf. Follow the acquirer's instructions on who sends which report.
5.2 Published scheme deadlines for compromised entities:
| Scheme | First notice | Forensic investigation | Reports and at-risk accounts |
|---|---|---|---|
| Visa (What To Do If Compromised v10.0) | Visa Global Risk Investigations within 3 calendar days of reasonable suspicion or confirmation; incident report (Attachment A) to Visa and acquirer within 3 calendar days of notifying Visa | If Visa requires a PFI: contract within 5 business days; preliminary report within 5 business days of contract. If Visa requires an independent investigation instead: retain within 5 business days, contain within 60 business days | At-risk account numbers within 3 calendar days of discovery, Visa's request or the window of exposure being set; final PFI report within 10 business days of completion |
| Mastercard (ADC Event Management Best Practices) | Within 24 hours, through the ADC Reporting Form on Mastercard Connect or the ADC mailbox | Engage a PFI promptly, within the timeframes in chapter 10 of the Security Rules and Procedures | Unedited forensic report as Mastercard requires |
| American Express (DSOP, October 2026) | Immediately and no later than 72 hours after discovery; initial notice form within 72 hours | PFI within five days of discovery for 10,000 or more unique card numbers; Amex may require one below that | Card numbers promptly; unedited PFI report within 10 business days of completion, on the PCI Forensic Incident Final Report Template; summary within 10 business days for smaller incidents |
5.3 Keep a deadline tracker with each clock, its start event, the due date and the person responsible. Send what you know by the deadline and update later: a late but complete report is worse than an on-time partial one. Discover and other networks set their own rules through the acquirer; confirm them in advance.
6. Engaging and working with the PFI
6.1 Choose from the current list. PCI SSC qualifies PFIs, requalifies them each year and says clients should check its list every time they engage one. A PFI must work for a Qualified Security Assessor company with a dedicated forensic practice. A firm marked "In Remediation" has been found not to meet all programme requirements.
6.2 Check independence before signing. Visa does not allow a PFI that is affiliated with the compromised entity or that has provided it with services in the past three years, including a previous PFI investigation, QSA assessment, consulting, monitoring or network security support. Your usual QSA or managed security provider often cannot act. Keep a pre-negotiated retainer with an eligible firm (NHI Mgmt Group recommendation).
6.3 Understand who the PFI reports to. The PFI delivers its reports directly to the schemes, and American Express requires the report unedited. Legal counsel may still engage the PFI and run a separate privileged investigation for litigation, but [Organisation] cannot shape the PFI's findings.
6.4 Give the PFI what it needs on day one: network and data flow diagrams for the cardholder data environment, asset lists, the last Report on Compliance or Self-Assessment Questionnaire, log sources and retention, third-party and remote access lists, and the incident timeline so far.
6.5 Track the timeline. Visa may charge a fee if a PFI investigation is not completed within four full calendar months: a flat USD 3,000 for Level 3 merchants, or USD 10,000 per month for Level 1 and 2 merchants. Delays in giving access are the merchant's cost.
6.6 Small merchants: some acquirers offer a lighter Visa investigation route. One UK acquirer, for example, publishes a "PFI Lite" option for Level 4 merchants with no more than three devices, fewer than 10,000 Visa transactions and no virtual terminal. Ask your acquirer whether a lighter route exists before contracting a full PFI.
7. Other notifications
- Data protection authorities: card data with a name is personal data. Under GDPR Article 33 and the UK GDPR, notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals. Assess Article 34 notification to individuals separately. See the Data Breach Notification Checklist.
- US state laws and other countries: most US state breach laws, as listed by the National Conference of State Legislatures, define personal information to include a name combined with a financial account or card number, often together with any required security code or password; check the definition in each state that applies with counsel. See the Breach Notification Laws by Country Guide.
- Law enforcement: Visa recommends notifying law enforcement. Agree with the PFI and counsel what is shared and when.
- Cyber insurer: most policies require prompt notice and pre-approval of forensic firms and lawyers. Check whether your retained PFI is on the insurer's panel.
- Customers: card issuers reissue or monitor affected cards, but customers may still need direct notice under data protection law. Use the Customer Breach Notification Letter Template.
8. Costs, assessments and revalidation
8.1 Scheme penalties are imposed on acquirers under scheme rules and passed to merchants under the merchant agreement. Published figures include:
| Item | Published figure | Source |
|---|---|---|
| Visa non-compliance assessment, Level 1 and 2 merchants | USD 100,000 | Visa What To Do If Compromised v10.0 |
| Visa non-compliance assessment, Level 3 merchants (tiered from 9 February 2025) | USD 5,000, 10,000 or 25,000 by annual transaction band, which Visa may raise to USD 100,000 | Visa What To Do If Compromised v10.0 |
| American Express data incident non-compliance fee | Up to USD 100,000 per data incident | American Express DSOP |
| Mastercard operational reimbursement and fraud recovery | Applied in larger events; one acquirer states this applies once 30,000 Mastercard accounts are affected | Acquirer guidance (Elavon UK) |
| Fee reductions | One acquirer states reductions of 25 to 100% for early self-notification and accurate PCI status, at the schemes' discretion | Acquirer guidance (Elavon UK) |
8.2 Add the costs schemes do not publish: PFI fees, card reissuance and fraud costs that issuers recover through the schemes, legal fees and data protection fines.
8.3 Revalidation: after the investigation, Visa requires the compromised entity to achieve PCI DSS compliance (and PCI PIN compliance where applicable), validated as the Visa Rules require. Mastercard requires the entity to become and remain compliant. Expect the acquirer to require a higher validation level, often an on-site assessment by a QSA, for a period after the event.
8.4 Reduce scope while you rebuild. Moving to validated point-to-point encryption, hosted payment pages or tokenisation can shrink the environment you must revalidate. See the PCI DSS Scoping and Network Segmentation Guide.
9. Recovery and post-incident review
9.1 Restore payment systems from known-good builds, not from backups taken during the window of exposure, once the PFI agrees containment.
9.2 Confirm that every credential used by the attacker, every vendor remote access path and every shared support account has been replaced, and that new credentials are individual and protected by MFA.
9.3 Within [30] days of closure (NHI Mgmt Group recommendation), hold a review covering: the trigger and how it was found, time from suspicion to each scheme notice, deadlines met or missed, PFI findings, root cause, cost, and changes to controls and contracts. The AI agent retail card theft campaign shows why the review must include machine credentials: it combined cloud keys, secrets manager dumps and stolen admin access across retailers.
9.4 Update this playbook, the PFI retainer and the acquirer contact list with what you learned.
Implementation guidance
- Do the preparation in peacetime: sign a PFI retainer with a firm that is independent of your QSA and managed service providers, record the acquirer's compromise procedure, and agree with your insurer which firms it will pay for.
- Know your merchant level per scheme: level drives assessment amounts and validation duties. Record it in section 2.
- Keep the evidence you will be asked for: cardholder data environment diagrams, asset inventory, 12 months of logs and an up-to-date list of third parties with access. Gaps here extend the PFI's work and the window of exposure, which defaults to the period you cannot prove was clean.
- Tabletop the clocks: run a scenario where a scheme names you as a common point of purchase on a Friday evening, and check you can meet a 24-hour Mastercard notice and a 72-hour American Express notice over a weekend.
- Measure readiness: time from trigger to acquirer notice in exercises, percentage of payment systems with log sources retained for 12 months, and whether the PFI retainer and contact list were reviewed in the last 12 months.
- Small versus large merchants: a small merchant on a hosted payment page needs this page, an acquirer contact and outsourced forensics. A large or multi-channel merchant needs a named payments incident lead, a retained PFI, pre-built transaction queries to count unique cards per scheme, and legal privilege planning.
Related guidance: the Retail Incident Response Guide covers the wider crisis, and the Point of Sale Security Guide covers preventing POS compromises.
Related NHI Mgmt Group resources: Web Skimming Incident Playbook · PCI DSS Requirement 12 Guide · Retail Incident Response Guide · Database Breach Response Playbook · Breach Notification Laws by Country Guide. Scheme rules change and bind you through your merchant agreement. Confirm against the official text before relying on it.