A Merchant Data Breach Gives the Acquirer 24 Hours to Tell Mastercard and Three Days to Tell Visa. What Both Networks Require After a Compromise.

When a merchant calls to say it thinks its checkout page or its point-of-sale system has been hacked, the call starts two network clocks at once. Mastercard's runs in hours. Visa's runs in days. Both start on suspicion, not confirmation, and both networks hold the acquirer responsible for meeting them, wherever the breach happened.

This piece sets out what the two networks require, from Visa's What To Do If Compromised guide, version 10.0, effective 25 June 2026, and Chapter 10 of Mastercard's Security Rules and Procedures, Merchant Edition, dated 4 August 2026.

When the Clock Starts

Visa requires a compromise event to be reported within three calendar days of discovering evidence sufficient to raise a reasonable suspicion of one, or to confirm one. Mastercard treats a customer as aware of an event when it or its agent first knew, or in the exercise of reasonable security practices should have known, about it. That includes being told by any source that malware exists on its own or an agent's systems.

Mastercard's definition of an agent covers any entity with access to account data through a relationship with the customer, merchants included, and makes the customer whose agent was compromised fully responsible for resolving the event. Visa's rules require an acquirer to investigate suspected compromise by its merchants and agents, and Visa sends its formal communications about an event to the acquirer or issuer of record. A merchant's breach is, for rules purposes, the acquirer's event.

The First 72 Hours

• Notify the network. Mastercard: within 24 hours of becoming aware, with ongoing updates. Visa: within three calendar days, through its Global Investigation Management Tool (GIMT) where the acquirer or its processor has access.
• Report what happened. Visa wants an Incident Report within three calendar days of the notification, covering the scope, the data at risk and the containment steps taken, with dates, plus the entity's PCI DSS and PIN security compliance status.
• Hand over the card numbers. Mastercard: all potentially affected Mastercard and Maestro account numbers, in its required format, as soon as possible and within 72 hours. Visa: all known or suspected compromised account numbers within three calendar days of discovering them, of Visa asking, or of a window of exposure being determined.
• Preserve the evidence. Mastercard requires it immediately and within 24 hours. Visa strongly recommends the same steps.

Both networks say not to restart or reboot the compromised systems. Visa adds that nobody should log on to them, even to change passwords, and that they should be taken off the internet and out of payment processing and isolated, for example by unplugging the network cable, rather than switched off. Logs, disk images and malware samples should be kept, including at any hosting or cloud provider. Mastercard says it may draw adverse inferences from evidence that data was deleted or altered.

A merchant told to wipe the till or reset every password before an investigator arrives may destroy the evidence the networks expect to see.

Forensic Investigations: When a PFI Is Required

Either network may require a PCI Forensic Investigator (PFI), a firm approved under the PCI Security Standards Council's program. Neither requires one for every event.

Visa decides case by case, and names Level 1 and 2 merchants, processors and service providers as more likely to need one, along with events tied to common-point-of-purchase fraud reports, reports from law enforcement, and failure to contain an earlier event. Once Visa requires a PFI, the contract must be signed within five business days, the preliminary report must reach Visa within five business days after that, and the final report within ten business days of the investigation ending.

Mastercard's timetable is tighter. Where it requires a PFI, the PFI must be engaged within 72 hours, and before work starts the customer must notify Mastercard of the proposed scope and get its preliminary approval. Mastercard must be told which PFI within two business days; the preliminary report is due within five business days of the investigation starting, and the final within ten business days of it ending.

Both protect the investigator's independence. Under Visa's guide, the PFI cannot be a firm that has provided the compromised entity with services in the past three years, including acting as its Qualified Security Assessor, so a merchant's usual assessor cannot investigate its breach. Mastercard requires the PFI to be free of conflicts as the PFI Program Guide defines them, and bars the customer or its agents from editing the report, directing the PFI to withhold information, or stopping it from talking to Mastercard directly.

The Lighter Routes for Smaller Merchants

Both networks allow a smaller investigation in some cases, and Visa's changed in June.

Visa may require an Independent Investigation instead of, or before, a PFI. The investigator still has to be retained within five business days, must be appropriately qualified, and should not be a firm that failed to identify or contain the event or did QSA work for the entity in the past three years. If the event is not contained within 60 business days, Visa may require a PFI and non-compliance assessments. Version 10.0 replaced the short list of what the final report had to contain with a strong recommendation to use the PCI SSC's Independent Incident Response Report Template; other formats must include all its required data elements in a substantially equivalent structure or may be rejected.

Mastercard's equivalent, the Alternative Acquirer Investigation, lets the acquirer investigate a Level 2, 3 or 4 merchant itself instead of hiring a PFI. Mastercard must determine that fewer than 50,000 accounts are at risk and that the merchant has had no compromise event in the previous 36 months, and the acquirer must determine that the merchant's acceptance system is not shared with or connected to other merchants and is not run by a service provider. The acquirer then has 30 business days from Mastercard's notice to confirm the investigation is complete and the event contained, with supporting evidence. For card-not-present events, the acquirer must also run 90 days of post-incident monitoring. A repeat event within 36 months can bring a required PFI and an assessment of up to US$25,000.

What It Can Cost

• Visa charges investigation fees if a PFI investigation runs past four full calendar months from its notice: a one-time US$3,000 for a Level 3 merchant, or US$10,000 a month for Level 1 and 2 merchants, processors, members and agents.
• Visa's non-compliance assessments for missing the guide's requirements reach up to US$100,000 per incident. For Level 3 merchants they start at US$5,000, US$10,000 or US$25,000 by annual transaction count, and Visa may raise them.
• Mastercard may assess up to US$100,000 for each violation of a PCI SSC requirement connected with a compromise event, and up to US$25,000 a day for each day a customer fails to follow the Chapter 10 procedures.
• Issuers can recover part of their costs: through Visa's Global Compromised Account Recovery program, where Visa decides acquirer liability, and through Mastercard's operational reimbursement, which may apply to events affecting 50,000 or more Mastercard accounts.

For a US or Canadian merchant, Mastercard halves the reimbursement where at least 75 percent of transactions ran through chip-capable terminals, and waives it at 95 percent. The merchant must also not have stored sensitive authentication data or had another compromise event in the prior 12 months. An acquirer has 30 calendar days to appeal Mastercard's final determination, for a non-refundable US$5,000 fee, and evidence it should have supplied during the investigation will not be considered.

After the Investigation

A compromise changes a merchant's compliance obligations. Under Mastercard's rules, the acquirer returns a compromise information form for the merchant, including a gap analysis, within 30 calendar days of receiving it. The merchant must reach full PCI DSS compliance within 180 calendar days of the end of the forensic investigation, evidenced by a QSA's Report on Compliance for a Level 1 or 2 merchant, or a Report on Compliance or Self-Assessment Questionnaire for Level 3 or 4. Mastercard will not grant extensions, and may reclassify any merchant with a confirmed compromise event as Level 1, with Level 1's annual validation requirements.

Visa requires every compromised entity to achieve PCI DSS compliance, and PIN security compliance where it applies, and requires the acquirer to show it can prevent a recurrence. If the relationship ends, Mastercard's MATCH Pro has reason codes for it: 01, Account Data Compromise, where the data was accessed and then used for fraud, and 12, PCI DSS non-compliance. Our earlier piece on MATCH Pro covers listing and removal.

What a Merchant-Services Team Should Have Ready

1. A same-day escalation path. Anyone in support or sales who hears a merchant say it may have been breached should know who to tell. Mastercard's 24 hours run from when the merchant knew, which may be before it called.
2. A script for the first call: do not reboot, wipe, reinstall or change passwords on the affected systems; disconnect them from the network; ask the hosting provider to keep logs.
3. Contract terms that make agents report. Mastercard requires the acquirer to ensure by contract that its agents notify Mastercard within 24 hours, and Visa's US rules require policies obliging agents to tell the acquirer about a breach. Merchant and ISO agreements should say the same.
4. Current security contacts. Mastercard sends compromise notices to the contacts in its My Company Manager application, and keeping them current is the customer's sole responsibility.
5. A post-event calendar: the 30-day form, the 180-day compliance deadline and any Level 1 reclassification, so the case does not close when the forensic report arrives.

None of this prevents a breach. It decides whether the acquirer meets the networks' deadlines when one happens.