Suspect a data breach? What a small store should do first

What should a small store do first if it suspects card data was exposed? Contact your processor first. A small business data breach response starts with a call to the company that handles your card payments, because they can help contain the problem, tell you what to do with your equipment, and coordinate with the card networks. The next steps are to preserve evidence, change passwords, and get qualified help.

Here's the straight version: the worst move is to panic and start wiping devices. The second worst is to do nothing and hope.

What are the signs of a possible breach?

A few signals come up often.

Your processor or bank calls to say cards used at your store are showing up in fraud.

Customers tell you their cards were used fraudulently after shopping with you.

You find a skimmer or a device on your card reader that doesn't belong.

Your POS or back-office computer behaves strangely: unknown programs, new user accounts, or remote access you didn't set up.

Someone gains access to your processor portal or email.

Any one of these is worth acting on. You don't need proof before you make the first call.

What should you do in the first hour?

Keep it calm and orderly.

1. Contact your processor. Tell them what you've seen and when. NRS Pay offers live support seven days a week. They'll tell you whether to keep using your equipment or switch to a backup.
2. Stop using any device you believe is compromised, if your processor advises it. Don't throw it away.
3. Don't wipe, reset, or reinstall anything. That can destroy the evidence investigators need.
4. Write down what you know: what happened, when you noticed, who has touched the equipment, and what you've done so far.
5. Change passwords for your POS, processor portal, email, and Wi-Fi from a device you trust. Turn on multi-factor sign-in where you can.

If you found a physical skimmer, take photos and contact local police as well.

What comes after the first hour?

Your processor may explain next steps, which can include an investigation by a qualified security firm, depending on the situation and card network rules.

Keep records of every call and email. Note names, dates, and what was agreed.

Look for the gap. How did it happen? A weak password, a guest Wi-Fi connection, an old reader, an unpatched computer? Fixing the cause matters as much as cleaning up.

There may be legal obligations, such as notifying customers or authorities, and those depend on your state and the situation. This post isn't legal advice. Talk to an attorney about your obligations, and check your state and local requirements.

The FTC's data security guidance for businesses is a good starting point for understanding what's expected. The PCI Security Standards Council sets the industry rules for protecting card data.

How do you lower the chance of a breach?

Prevention is mostly habits.

Use up-to-date card readers that support chip and tap, and let them update.

Never store card numbers on paper or in files.

Give every employee their own login and remove access when they leave.

Keep payment devices on a private network, not the guest Wi-Fi.

Check your card reader for tampering every day.

Complete your annual PCI questionnaire honestly.

None of this makes a breach impossible. It makes one much less likely. If your reader is old or unsupported, NRS Pay offers a free card reader with signup, and the NRS Pay team can help you review your setup. You can also see NRS Pay equipment.