When a merchant finds out,
either because its acquiring bank has told them or because it suspects ---
because I've seen lots of chats on the internet about,
hey, this company's had a breach.
Have you had to use your card there?
What should the merchant do?
Well the first thing, if a merchant finds that they've got a breach,
is they have to notify their acquirer.
That's a requirement.
They need to notify their acquiring bank as soon as they find out,
but absolutely no later than 24 hours.
Are they going to get into trouble for that?
They are required to.
It's not a matter if they're going to get in trouble or not,
but it's a requirement of the merchant process.
So it's in their contract with the acquiring bank and with the
card schemes that if you suspect a data breach,
you have to ring up the acquiring bank.
Yeah.
There could be a lot more on the line of whether anybody gets in trouble or not.
These merchants could be part of a broader scheme where
millions of credit cards are being hit,
and that little piece that they're seeing on their side could be
the key to stopping this on a massive national,
even an international, scale.
So they shouldn't ring you up.
They shouldn't ring a PFI up.
They should rind their acquiring bank up.
Correct.
If they call me up, my first bit of advice would be to call your acquiring bank.
Okay.
That's pretty clear then.
Ring up your acquiring bank.
So how do you get engaged?
Well, when a merchant is required to have a forensic investigation,
they're usually presented a list by their acquirer,
which comes from the council's website,
where they can select any number of a small handful of firms
that are licensed to do this type of work.
Okay,
and then the merchant rings you up directly or the
acquiring bank rings you up directly?
Usually the merchant calls us.
They have some say over which forensic company they'd like to go with,
so most of the time we hear from the acquiring bank.
Sometimes we'll hear from legal representation,
but usually, the merchants call us up.
Okay.
This is a high stress point for any merchant, isn't it?
It absolutely is.
If people are watching this,
and we hope the people watching this haven't been breached,
and they're thinking, oh,
should I have a relationship with a PFI before I'm breached?
Does that, because they'll have to contract with you.
That must take quite a while in a time-critical scenario.
It can take some time; however,
if you have a preexisting contract with a merchant,
you are not then allowed to perform that duty,
conflict of interest.
Because if you've worked for them already,
you might be like marking your own homework basically.
Yeah, I get that.
Okay.