Deeper Dive: Merchant Liability Arising From Stolen Payment Cards

For merchants, accepting payment cards is not really a choice. Many merchants, however, are unaware of how that "choice" subjects them to significant potential liability in the event payment card data from cards swiped at the point-of-sale is stolen from their payment network. Often casually (but incorrectly) referred to as "PCI fines and penalties," the contracts merchants sign with their acquiring bank/payment processor or directly with a card network impose an obligation to indemnify the acquirer/processor or card network from the expenses incurred by issuers of affected cards, including fines, fees, card reissuance, and counterfeit fraud.

2016 Data Security Incident Response Report