WEBVTT

00:00:00.000 --> 00:00:01.937
When a merchant finds out,

00:00:01.937 --> 00:00:06.051
either because its acquiring bank has told them or because it suspects ---

00:00:06.051 --> 00:00:08.339
because I've seen lots of chats on the internet about,

00:00:08.339 --> 00:00:10.079
hey, this company's had a breach.

00:00:10.080 --> 00:00:11.918
Have you had to use your card there?

00:00:11.919 --> 00:00:15.214
What should the merchant do?

00:00:15.214 --> 00:00:18.144
Well the first thing, if a merchant finds that they've got a breach,

00:00:18.144 --> 00:00:20.054
is they have to notify their acquirer.

00:00:20.054 --> 00:00:21.149
That's a requirement.

00:00:21.150 --> 00:00:24.974
They need to notify their acquiring bank as soon as they find out,

00:00:24.974 --> 00:00:28.839
but absolutely no later than 24 hours.

00:00:28.839 --> 00:00:31.081
Are they going to get into trouble for that?

00:00:31.081 --> 00:00:34.025
They are required to.

00:00:34.026 --> 00:00:36.584
It's not a matter if they're going to get in trouble or not,

00:00:36.584 --> 00:00:39.784
but it's a requirement of the merchant process.

00:00:39.784 --> 00:00:42.835
So it's in their contract with the acquiring bank and with the

00:00:42.835 --> 00:00:45.666
card schemes that if you suspect a data breach,

00:00:45.666 --> 00:00:48.084
you have to ring up the acquiring bank.

00:00:48.084 --> 00:00:48.375
Yeah.

00:00:48.375 --> 00:00:53.374
There could be a lot more on the line of whether anybody gets in trouble or not.

00:00:53.374 --> 00:00:55.998
These merchants could be part of a broader scheme where

00:00:55.998 --> 00:00:58.049
millions of credit cards are being hit,

00:00:58.049 --> 00:01:01.303
and that little piece that they're seeing on their side could be

00:01:01.303 --> 00:01:04.684
the key to stopping this on a massive national,

00:01:04.684 --> 00:01:06.198
even an international, scale.

00:01:06.198 --> 00:01:07.814
So they shouldn't ring you up.

00:01:07.814 --> 00:01:08.927
They shouldn't ring a PFI up.

00:01:08.928 --> 00:01:10.335
They should rind their acquiring bank up.

00:01:10.336 --> 00:01:10.683
Correct.

00:01:10.683 --> 00:01:15.796
If they call me up, my first bit of advice would be to call your acquiring bank.

00:01:15.797 --> 00:01:15.985
Okay.

00:01:15.985 --> 00:01:16.741
That's pretty clear then.

00:01:16.741 --> 00:01:19.079
Ring up your acquiring bank.

00:01:19.080 --> 00:01:22.351
So how do you get engaged?

00:01:22.352 --> 00:01:27.426
Well, when a merchant is required to have a forensic investigation,

00:01:27.427 --> 00:01:29.587
they're usually presented a list by their acquirer,

00:01:29.587 --> 00:01:31.840
which comes from the council's website,

00:01:31.840 --> 00:01:36.369
where they can select any number of a small handful of firms

00:01:36.369 --> 00:01:38.941
that are licensed to do this type of work.

00:01:38.941 --> 00:01:39.149
Okay,

00:01:39.149 --> 00:01:41.574
and then the merchant rings you up directly or the

00:01:41.574 --> 00:01:43.514
acquiring bank rings you up directly?

00:01:43.514 --> 00:01:45.058
Usually the merchant calls us.

00:01:45.058 --> 00:01:50.211
They have some say over which forensic company they'd like to go with,

00:01:50.211 --> 00:01:52.872
so most of the time we hear from the acquiring bank.

00:01:52.872 --> 00:01:56.363
Sometimes we'll hear from legal representation,

00:01:56.363 --> 00:01:59.553
but usually, the merchants call us up.

00:01:59.554 --> 00:01:59.872
Okay.

00:01:59.872 --> 00:02:03.296
This is a high stress point for any merchant, isn't it?

00:02:03.296 --> 00:02:04.480
It absolutely is.

00:02:04.480 --> 00:02:06.617
If people are watching this,

00:02:06.617 --> 00:02:09.764
and we hope the people watching this haven't been breached,

00:02:09.764 --> 00:02:11.660
and they're thinking, oh,

00:02:11.660 --> 00:02:15.904
should I have a relationship with a PFI before I'm breached?

00:02:15.904 --> 00:02:18.383
Does that, because they'll have to contract with you.

00:02:18.383 --> 00:02:22.528
That must take quite a while in a time-critical scenario.

00:02:22.529 --> 00:02:25.463
It can take some time; however,

00:02:25.463 --> 00:02:29.121
if you have a preexisting contract with a merchant,

00:02:29.121 --> 00:02:33.085
you are not then allowed to perform that duty,

00:02:33.085 --> 00:02:34.479
conflict of interest.

00:02:34.480 --> 00:02:36.113
Because if you've worked for them already,

00:02:36.114 --> 00:02:38.431
you might be like marking your own homework basically.

00:02:38.431 --> 00:02:42.431
Yeah, I get that.

00:02:42.431 --> 00:02:43.431
Okay.