PFI - PCI Forensic Investigator

A PCI Forensic Investigator (PFI) is an organization qualified by the PCI Security Standards Council to perform forensic investigations following confirmed or suspected compromises of payment card data. PFI engagement is typically required by the card brand notification process when a merchant or service provider experiences a cardholder data compromise; the acquiring bank or card brand directs the engagement.

When PFI Engagement Is Required

Card brand notification processes (Visa AIRS, Mastercard ADC, American Express EIRP, Discover DISC, JCB) typically require a PFI engagement once a cardholder data compromise is confirmed or strongly suspected. The acquiring bank directs the entity to select a PFI from the PCI SSC list, often within 24 to 48 hours of the brand notification.

What a PFI Investigation Covers

• Forensic acquisition and preservation of affected systems
• Determination of compromise scope: systems, accounts, cardholder data exposed
• Determination of the compromise timeline (window of exposure)
• Analysis of attack vectors and adversary techniques
• Assessment of PCI DSS compliance state at time of compromise
• Final PFI report to the entity, acquiring bank, and card brands

PFI Selection and Independence

PFIs must remain independent from the entity under investigation. A QSA (Qualified Security Assessor) that performed the entity's compliance assessment cannot serve as the PFI for that entity. Selection is typically from a short list provided or approved by the acquiring bank, and the engagement letter goes through counsel where privilege is desired.