Okay,
so what I want to run through first of all is how does an
organization find out it has a data breach?
Well, hopefully they don't find out from Krebs.
That's the worst way to find out.
A lot of times merchants find out when a customer notifies them and says,
hey, I've got this brand-new card.
You're the only company I've used it at, and now it's being used fraudulently.
Or they'll find out from their acquirer.
The acquirer will call up and say, hey, our algorithms have tripped,
and your location seems to be leaking card data.
So, what'd you mean by that?
The acquiring bank is looking for this happening?
Yes.
The card brands and the acquirers are watching the
transactions on the back end looking for different anomalies
that they call the common point of purchase,
and they use different algorithms at each card brand,
or each acquirer,
to just monitor to see which cards can be
triangulated back to a specific merchant.
Yeah.
When I was a Visa, we used to run this in the background basically.
You looked at all the fraudulent transactions.
You tried to take them back to, were they all used in the same place?
Correct.
And that's that common point of purchase, or CPP.