What This Alert Means.
This alert means card data linked to your customers has appeared for sale in an underground shop. These shops, often called carding markets, sell stolen card numbers to people who use them for fraud. The alert does not tell you how the cards were stolen. They may have come from your own checkout, from a third party, or from a malware infection on the customer's own device.
Your first question is therefore "what do these cards have in common?" If many of the cards were used on your site, your payment flow is a suspect. If they share nothing, the leak may be elsewhere. Do not assume either answer before you check.
First 24 Hours.
Work in this order. Each step names who does it.
- SOC analyst Open the alert from the Brandefense dark web monitoring module and record the listing, card ranges (BINs, the first digits that identify the issuing bank), dates and any sample dataSave a copy of the evidence before anything changes
- Fraud analyst Match the listed cards against your own orders and look for the ones used on your siteA strong match points to your checkout as the source
- IT admin Check the payment pages for unexpected scripts or changes to the checkout codeSkimming code on a checkout page can copy card details as customers type
- Fraud analyst Tighten your fraud rules for the affected card ranges, for example extra checks on new orders and many small test paymentsKeep the changes easy to undo
- Payments manager Contact your acquirer or payment processor and tell them what you foundThey manage the link to the card networks and can advise on next steps
- Legal Ask whether anyone must be notified, including customers and card brandsCheck with your legal counsel before you send anything
- Communications Prepare a short, factual holding note for support staffDo not name the underground shop or share card data in it
Investigation Checklist.
Use this list to find the source and the size of the problem. Tick each item and keep notes.
- Do the listed cards share a first use or a purchase on your site in the same period?A shared window narrows down the time of the leak
- Did the cards come from your own card form, or from a hosted payment page run by a provider?The answer decides who must investigate
- Were checkout pages, tag manager settings or third-party scripts changed recently?Review change logs and file hashes
- Do the sample records include the security code or only the number?This shows how much the thief can do with each card
- Do you store card numbers in databases, logs, backups or support tickets?Old copies are easy to forget
- Are the same customers also appearing in leaked credential or stealer log alerts?The cause may be the customer's own infected device
- Are there signs of testing, such as many small payments or declined attempts?This can mean someone is checking whether the cards still work
- Have chargebacks or card network fraud reports increased on the same cards?These show the size of the loss
Containment And Removal.
You cannot remove card data from an underground shop. Containment means finding and closing the source, making the cards less useful and passing the facts to the parties who can cancel the cards. The payment card industry has its own channels, so use them.
- Acquirer or payment processor: report what you found and ask what they need from you. The PCI Security Standards Council says it does not enforce compliance. Whether an entity must validate compliance is decided by organizations that run compliance programs, such as a payment brand or acquirer.
- Card issuers and networks: through your acquirer, give the card numbers or ranges so the issuing banks can block or reissue the cards. Do not email full card numbers in plain text.
- Your payment provider: if you use a hosted payment page, ask the provider to check their side and share their findings.
- Hosting or script provider: if you find skimming code, ask the host of that script to remove it and keep logs of where it loaded from.
- Law enforcement or national CERT: report organized fraud to your national police cyber unit. In Turkiye, USOM (usom.gov.tr) handles cyber incident reporting, and its services are moving to www.siberguvenlik.gov.tr.
- CollectCard ranges, dates and sample data from the alert
- Find the sourceMatch against your orders, checkout and storage
- ReportAcquirer first, then card issuers through them
- TightenFraud rules and checkout controls
Longer-Term Hardening.
The aim is to hold less card data and to notice problems earlier. Start with the payment flow.
- Store less. If you do not need a card number, do not keep it. Use a hosted payment page or tokens from your payment provider, so your systems never see the full number.
- Check scripts on payment pages. Keep a list of every script that loads on checkout, remove those you do not need and alert on changes.
- Review PCI scope with your acquirer. Ask which PCI requirements apply to you, and read the public documents on the PCI Security Standards Council website for the standards themselves.
- Rule tuning. Keep velocity limits (how many attempts one card, device or address can make), address checks and step-up checks for risky orders. Review them after each alert.
- Prepare in advance. NCSC says that only one thing helps you deal well with a cyber incident: good preparation. NIST SP 800-61 Rev. 3 gives recommendations to help you prepare for and respond to incidents. Write down who calls the acquirer, who talks to customers and who decides.
- Customer account security. Offer MFA for customer accounts and warn customers about phishing that asks for card details.
How To Measure That It Worked.
Pick measures you already track, and compare before and after the alert.
- Fewer new fraud chargebacks on the cards from the alert.
- The source is named and closed, with a written note of what you found.
- No further listings of the same card ranges in later alerts.
- Your acquirer confirms they have what they need, and issuers have been given the card ranges.
- Checkout scripts match your approved list on each review.
- Counsel has signed off on the customer and regulator question, and the record is stored.
Common Mistakes.
These mistakes cost time or make the loss larger.
- Assuming it is your fault, or not. Cards can leak from many places. Check first, then say what you know.
- Blocking too much. Blocking every order from a card range hurts honest customers. Add checks before you add blocks.
- Telling customers before counsel reviews the wording. Ask counsel what is needed and when.
- Sending card numbers by email or chat. Use the secure channel your acquirer gives you.
- Ignoring old data. Backups, logs and tickets may hold card numbers that nobody remembers.
- Closing the alert after a fraud rule change. A rule does not fix a leak at the source.
Questions.
-
What does it mean when my customers' cards are for sale on the dark web?
It means card data linked to your customers has been listed in an underground shop. It does not prove your systems were breached. Cards can be stolen from many places, including customers' own devices. Check your orders, checkout and storage to find what they have in common.
-
Who do I contact first about stolen payment cards?
Contact your acquirer or payment processor first. They manage the link to the card networks and issuing banks and can tell you what they need. The PCI Security Standards Council says compliance programs are run by payment brands, acquirers or other bodies, not by the Council itself.
-
Do I need to tell my customers about stolen card data?
Ask your legal counsel. Whether and when to notify depends on where the cards were stolen, where you and your customers are based, and your contracts. Prepare a plain, factual note in advance, but send nothing until counsel has reviewed it.
-
Does PCI SSC handle breaches or enforce compliance?
No. PCI SSC says its role is to develop and maintain standards and that it does not monitor how they are applied. Payment brands, acquirers or other bodies decide who must validate compliance, so your acquirer is the right contact.
-
How do I tighten fraud rules after a card leak alert?
Add extra checks for the affected card ranges, limit how many attempts one card, device or address can make, and review orders that look like card testing. Prefer added checks to hard blocks, so honest customers are not turned away. Review the rules after each alert.
Sources
This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.