Expectations From a PCI Forensic Investigation After a Card Data Compromise

What Is a PCI Forensic Investigation?

A PCI forensic investigation is an independent investigation of a suspected or confirmed payment card data compromise, performed by a PCI Forensic Investigator (PFI) company approved by the PCI Security Standards Council (PCI SSC). It establishes the facts for the affected card brands and acquirers.

A PFI is not an ordinary incident response firm. According to the PCI SSC PFI Program Guide, a company must already be a Qualified Security Assessor (QSA) company before it can become a PFI company, and it may investigate only in the regions for which it is approved. Card brands accept investigation reports only from approved PFIs, and you can confirm a firm’s status on the PCI SSC list of PCI Forensic Investigators.

When Is a PFI Investigation Required After a Card Data Compromise?

A PFI investigation is required when a card brand formally instructs the compromised entity to engage one, usually after a suspected or confirmed breach is reported or detected through fraud patterns. The PCI SSC does not set this trigger; each brand applies its own rules.

Visa’s What To Do If Compromised guide, version 10.0, effective June 25, 2026, sets out the obligations most US merchants and service providers will face first:

Obligation	Visa Deadline
Notify Visa of a suspected or confirmed compromise	Within 3 calendar days of discovery
Submit the incident report to Visa and the acquirer	Within 3 calendar days of notifying Visa
Submit known or suspected compromised account numbers	Within 3 calendar days
Sign the PFI contract and notify Visa of the PFI and lead investigator	Within 5 business days of the PFI requirement
Deliver the preliminary PFI report	Within 5 business days of signing the PFI contract
Deliver the final PFI report	Within 10 business days of investigation completion

Other brands have their own compromise procedures, so confirm requirements with your acquirer as soon as an incident is suspected.

What Happens During a PCI Forensic Investigation?

A PCI forensic investigation moves through engagement, evidence collection, analysis, and reporting, with the PFI working independently and reporting to the brands throughout.

Engagement and consent: You sign a contract with the PFI. Before work begins, the PFI must obtain your consent to share its reports with the affected brands and acquirers.
Preliminary incident response report: The PFI documents initial scope, containment status, and early observations.
Evidence acquisition: Investigators collect forensic images, logs, network data, and, where relevant, physical devices such as payment terminals.
Analysis: The PFI reconstructs attacker activity, identifies compromised systems, and determines which card data elements were at risk.
Final report: The PFI completes the PCI SSC report template, and the brands review it and may reject it if it falls short.

Expect requests for broad access to systems, staff, and third-party providers.

What Does a PFI Report Include?

A PFI report establishes how the compromise happened, what card data was exposed, and whether the threat is contained. Based on the PFI Program Guide, the investigation determines:

The scope of the investigation and the sources of evidence.
The root cause and method of compromise.
The window of vulnerability and window of intrusion.
The number of accounts and the card data elements at risk.
Whether the incident is contained and card data is no longer at risk.
The PCI standards that apply and the entity’s PCI status at the time of the incident.

The last point carries significant weight. The PFI assesses whether relevant PCI DSS controls were in place when the breach occurred, so gaps in logging, segmentation, or access control will appear in a report the brands rely on. If PIN data was compromised, a PIN Security Requirements Report is also required.

How Should Organizations Prepare for and Support a PFI Investigation?

The most important preparation is preserving evidence and containing the incident without destroying what investigators need. Visa’s guidance is explicit about what to avoid:

Do:

Isolate compromised systems from the network rather than shutting them down.
Preserve forensic images and security, web, database, and firewall logs.
Document every containment action with times, people, and steps taken.
Ask hosting and cloud providers to retain logs and system images.

Do not:

Log in to, alter, or change passwords on compromised systems.
Power off, restart, or reboot compromised systems.
Use compromised systems to process payments.

Your PCI DSS Requirement 12.10 incident response plan should already define these steps and who contacts the acquirer, counsel, and insurer. Organizations with mature incident response capabilities and log retention practices give the PFI clearer evidence and often face fewer open questions in the final report.

What Are the Common Mistakes During a Card Data Compromise?

The most damaging mistakes happen before the PFI arrives, when internal actions alter evidence. Common issues include:

Wiping or rebuilding systems too early, which removes the evidence needed to determine the window of intrusion.
Dnotification while internal teams investigate, which risks missing brand deadlines.
Insufficient log retention, which leaves the PFI unable to confirm when the attack began or which data was exposed.
Overlooking third parties, such as e-commerce platforms or managed service providers that hold relevant logs.
Treating the final report as the end of the process rather than the start of remediation.

Prolonged investigations also carry direct costs. Visa’s guide lists investigation fees of $10,000 per month for Level 1 and Level 2 merchant cases that remain open after a grace period.

What Should Organizations Do After a PCI Forensic Investigation?

After the investigation, organizations must remediate the root causes the PFI identified and validate PCI DSS compliance again under the card brand rules. Visa requires compromised entities to validate PCI DSS compliance once the investigation ends.

This phase benefits from a structured approach:

Map every PFI finding to a remediation action, owner, and deadline.
Rebuild affected systems from known-good baselines and verify configurations.
Strengthen logging, monitoring, and segmentation where the PFI identified gaps.
Run a PCI DSS readiness and gap assessment before formal revalidation.
Test the incident response plan against lessons learned.

Ampcus Cyber supports organizations across this lifecycle with cybersecurity forensics and incident response investigations, digital forensics, and PCI DSS compliance services delivered by PCI QSA professionals. This helps organizations close the gaps a breach exposes and return to validated compliance.

Preparing for a PCI Forensic Investigation Before You Need One

A PCI forensic investigation follows fixed rules and timelines that leave little room for improvisation once a card data compromise is suspected. Organizations that preserve evidence, notify promptly, and maintain strong logging and incident response practices give investigators a clearer picture and face a shorter path back to compliance. Preparation, not reaction, determines how much a breach ultimately costs.

Is your payment environment ready for a forensic investigation?

Talk to Ampcus Cyber’s PCI and incident response specialists to assess your breach readiness, strengthen evidence preservation, and close PCI DSS gaps before an incident tests them.