A card breach, and the sequence that follows it.
The costs that follow a card data breach are mostly not the fraud itself. They are the forensic investigation, the network assessments, the reissuance of affected cards, and the compliance obligations you inherit afterwards.
What this page settles.
Three questions, in the order most people ask them.
How a breach gets discovered
Almost never by the merchant.
The usual route is common point of purchase analysis. Issuing banks see fraud on a batch of cards, the networks look for what those cards have in common, and your business is the overlap. You find out when your acquirer calls.
The other routes: a payment provider or security vendor notifies you; law enforcement notifies you; your POS vendor discloses a compromise affecting their customers; or, occasionally, you notice something yourself.
What this means practically is that by the time you know, the networks already have evidence and a timeline. The discovery stage is not one where you have much initiative, which is why the preparation matters more than the response.
The sequence that follows
Reasonably standard across the networks, and faster than people expect.
1. Notification and containment. Your acquirer tells you there is a suspected account data compromise. Expect an immediate instruction to preserve everything — logs, systems, terminals — and not to wipe or rebuild anything. Wiping a compromised system destroys the evidence that might limit your liability.
2. A forensic investigator is appointed. For breaches above certain thresholds, the networks require an investigation by an approved forensic investigator from their own list. You do not choose freely and you do not get to decline. The investigator reports to the networks and the acquirer, not to you.
3. The report. It establishes what was taken, how many card numbers were exposed, the window of exposure, and — this is the part that costs money — whether you were compliant with the security standard at the time. PCI DSS explained.
4. Assessments and recovery. The networks assess the acquirer for non-compliance and for the cost of fraud and reissuance attributable to your breach. The acquirer passes this to you under your merchant agreement.
5. The aftermath. You are typically required to re-validate compliance at a higher level than before — frequently an on-site assessment by a qualified security assessor rather than a self-assessment questionnaire, repeated annually for a period. Your acquirer may also impose a reserve or review whether to keep your account.
Running alongside all of this: state breach-notification obligations, which are legal rather than contractual, have their own deadlines, and are a question for a lawyer the same week.
What it costs
Published figures for breach costs are mostly drawn from large incidents and are not a useful guide for a small merchant. What is useful is knowing the categories, because they are the same at every size.
The forensic investigation. You pay for it. For a small environment this is the smaller end of a wide range, and it is not optional.
Network assessments. Levied for non-compliance and for the compromise itself, and scaled to the number of accounts exposed.
Card reissuance and fraud recovery. The issuers’ cost of cancelling and reissuing every exposed card, plus fraud losses attributed to the breach, recovered through the networks. On a merchant who exposed a few thousand card numbers over several months, this is usually the largest single line.
Remediation. Replacing compromised systems, closing whatever was open, and the higher compliance regime afterwards.
The part nobody budgets: your own time, your acquirer’s confidence in your account, and in some cases your ability to keep processing at all.
The useful summary is that the exposure is driven by how many card numbers were reachable and for how long — not by your revenue. A small shop with a compromised POS that touched 8,000 cards over six months faces a materially larger problem than a larger business whose environment never held a card number.
Who is actually liable
The chain matters, because it explains why “it was not my fault” does not resolve it.
The networks’ contractual relationship is with the acquirer. The acquirer’s contractual relationship is with you. Your merchant agreement makes you responsible for the security of your own payment environment — including systems operated by vendors you chose.
So if your POS vendor’s remote-access tool was the way in, the networks assess the acquirer, the acquirer charges you, and whether you can recover from the vendor is a separate matter governed by a separate contract that may well limit their liability to the fees you paid them.
Two practical consequences. First, read what your POS or gateway contract says about security responsibility and indemnification before you sign it, because that is your only leverage after an incident. Second, your own compliance posture at the time of the breach is the single biggest variable in what you end up paying — which is the entire argument for taking the questionnaire seriously rather than clicking through it.
The three things that reduce exposure
In order of how much they help.
Do not have the data. Nothing protects card numbers like not holding them. This is what tokenization and point-to-point encryption do: the card is encrypted in the reader and your systems only ever see a token. A merchant whose environment never contains a card number has very little to lose in a breach, and a much shorter questionnaire besides.
This also means going looking for the data you did not realise you had. In small businesses, card numbers accumulate in places nobody thinks of: email inboxes where customers sent details, paper order forms in a drawer, notes in a CRM, a spreadsheet of recurring customers, a voicemail system. All of that is in scope and all of it is a liability with no upside. Find it and destroy it.
Segment and patch what remains. If you must run a networked POS, keep it off the same network as the guest wi-fi, the office laptops and the camera system. Change default passwords. Turn off remote access you do not use, and put multi-factor authentication on the remote access you do. The majority of small-merchant compromises come through remote access left open with a weak password.
Be compliant, demonstrably. Complete the right self-assessment questionnaire honestly, run scanning if your level requires it, and keep the records. Compliance does not make you immune. It changes the forensic report from “the merchant was non-compliant in these respects” to “the merchant was compliant and was nonetheless compromised”, and those two reports produce very different bills.
Breach insurance, and what it covers
Many acquirers include or offer a breach-cost program, sometimes bundled with the annual PCI fee. Some are genuinely useful and some are close to decorative, so read the specifics.
What to check:
The cap. Often per-incident and modest. Compare it to the categories above rather than to a reassuring headline number.
The compliance condition. Almost all of these programs exclude or reduce cover if you were not compliant at the time. This is the clause that most often turns cover into no cover.
What is actually covered. Forensics and assessments, usually. Your own remediation, business interruption and legal costs, often not.
Whether you are already paying for it. If a PCI program fee on your statement includes a breach program, you have it. Buying a second one separately is a thing that happens. PCI compliance fees.
What we charge
Interchange + 0.50% + 10¢ in person, interchange + 0.75% + 25¢ keyed, with no contract, no monthly fee and no monthly minimum.
The useful thing we do here costs nothing: walk your setup with you and establish where card data actually touches your business. Most merchants find at least one place they had forgotten about, and removing it is the cheapest risk reduction available.
While we are on the subject
Can a small merchant really be fined?
The networks assess the acquirer, and the acquirer passes it to the merchant under the merchant agreement. The mechanism is indirect; the bill is not.
Does being PCI compliant protect me?
It reduces your exposure substantially and is the main thing that helps if you are investigated. It is not a guarantee, and compliance at the time of the breach is what matters, not compliance last year.
What if the breach was my POS vendor's fault?
You may have recourse against them contractually. Your acquirer’s claim is still against you, because your merchant agreement makes you responsible for your environment.
Do I have to notify customers?
State breach-notification laws generally require it, and the thresholds and timelines vary. This is a question for a lawyer in your state, promptly.