What To Do If Compromised - Visa Supplemental Requirements

What To Do If Compromised Visa Supplemental Requirements

Important Note on Copyright

This document is protected by copyright restricting its use, copying, distribution, and decompilation. No part of this document may be reproduced in any form by any means without prior written authorization of Visa.

Visa and other trademarks are trademarks or registered trademarks of Visa. All other product names mentioned herein are the trademarks of their respective owners.

About Visa Supplemental Requirements

This document is a supplement of the Visa Core Rules and Visa Product and Service Rules. In the event of any conflict between any content in this document, any document referenced herein, any exhibit to this document, or any communications concerning this document, and any content in the Visa Core Rules and Visa Product and Service Rules, the Visa Core Rules and Visa Product and Service Rules shall govern and control.

Contents

1. Summary
2. Section A: Requirements for Entities that Suspect or Have Confirmed a Compromise Event
   1. Submit Notification to Visa Within Three (3) Calendar Days
   2. Perform Initial Investigation and Provide Incident Report
   3. Provide Notice to Other Relevant Parties
   4. Provide At-Risk Payment Account Data to Visa
   5. Conduct PCI Forensic Investigation (PFI)
   6. Conduct Independent Investigation
   7. Preserve Evidence
3. Section B: Requirements for Visa Members
   1. Submit Notification to Visa
   2. Perform Initial Investigation and Provide Incident Report
   3. Provide At-Risk Payment Account Data
   4. Manage PCI Forensic Investigation (PFI)
4. Attachment A: Incident Report

Summary

Visa is dedicated to promoting the safe and sound long-term prosperity of the Visa payment ecosystem. To that end, Visa aims to ensure the timely resolution of external data compromise events, drive notification of at-risk accounts to stem fraud impacts, and synthesize forensic evidence, intelligence, and fraud analysis to formulate remediation plans that strengthen payment system security. Protecting the payment ecosystem is a shared responsibility. Any entity that stores, processes, or transmits payment card data or has access to those systems or data, is required to adhere to the Payment Card Industry Data Security Standard (PCI DSS) requirements and (PCI) – PIN Security Requirements.

Section A: Requirements for Entities that Suspect or Have Confirmed a Compromise Event

Any entity that suspects or confirms unauthorized access to and/or misuse of any Visa cardholder data, including any entity that stores, processes, or transmits cardholder data or has access to a payments environment or systems, is required to adhere to the WTDIC requirements.

1. Submit Notification to Visa Within Three (3) Calendar Days

1.1. An entity that suspects or confirms unauthorized access to any Visa payment account data is required to ensure that the Compromise Event is reported to Visa’s Global Risk Investigations group within three (3) calendar days of either:
a. The discovery of evidence sufficient to raise a reasonable suspicion of a Compromise Event,
b. The discovery of evidence sufficient to confirm the existence of a Compromise Event.

Visa Members are responsible for ensuring compliance with this requirement by their affiliates, agents, and customers.

1.2 Visa Acquirers and Third-Party Processors with access to Visa’s Global Investigation Management Tool (GIMT) must provide notice via GIMT.

1.3 All other notifications must be provided to the appropriate regional Visa Global Risk Investigations group.

2. Perform Initial Investigation and Provide Incident Report

2.1 Within three (3) calendar days of notifying Visa in accordance with Section A-1 above, provide a report describing the event (the “Incident Report”) to Visa and the Acquiring bank (if applicable).

2.2 The information provided aids Visa in understanding the compromised entity's network environment, potential scope of the incident, potential payment card data at risk, estimated financial exposure where known, and containment status of the Compromise Event.

3. Provide Notice to Other Relevant Parties

3.1. Immediately notify all relevant parties, including but not limited to the Issuing/Acquiring Bank (if applicable).

3.2. Notify your internal incident response team and information security group.

4. Provide At-Risk Payment Account Data to Visa

4.1 Entities are required to ensure that all compromised Visa account numbers (known or suspected) are provided to Visa’s Global Risk Investigations group via Visa’s GIMT or Compromised Account Management System (CAMS) within three (3) calendar days of any of the following scenarios:
a. Discovery of compromised account data.
b. The date Visa requests at-risk account numbers; or
c. A Window of Exposure (WOE) is determined.

5. Conduct PCI Forensic Investigation (PFI)

5.1. Visa may, at its discretion, require a potentially compromised entity to engage a Payment Card Industry (PCI) Forensic Investigator (PFI) to perform an investigation.

6. Conduct Independent Investigation

6.1. Not all Compromise Events necessitate a PFI. Visa may require the entity to conduct an Independent Investigation.

7. Preserve Evidence

7.1. To identify the root cause of a potential Compromise Event, preserve all evidence. Do not access or alter compromised system(s).

Section B: Requirements for Visa Members

1. Submit Notification to Visa
2. Perform Initial Investigation and Provide Incident Report
3. Provide At-Risk Payment Account Data
4. Manage PCI Forensic Investigation (PFI)

Attachment A: Incident Report