If you really want to know, sue them. ---- File a John Doe lawsuit, "plaintiff to be determined", and then subpoena the relevant information from Mastercard. John Doe doesn't countersue, so you're pretty safe doing this. But it probably won't work. Mastercard would quash your subpoena. They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point). After all, as the pig said to the chicken when they opened a breakfast cafe... You may be involved, but I'm *committed*! Mastercard entirely indemnified you from loss, but there aren't any money-gods magically indemnifying Mastercard. They are "all in" to solve a very hard problem of credit card fraud. This is total war. Amy's Waffles is not the enemy. ---- And foot soldiers don't get to know what's going on, due to OpSec. Fortunately Visa and M/C don't have to settle for who'll work for government pay. They can hire the best of the best, and they locate where those people are (Visa halfway between Silicon Valley and San Francisco, Mastercard outside NYC.) They are after the people doing the hacking, and the security gaps which make the hacking possible. Lots of us have been lucky, but if you've *really* tried to secure a PC, this itself is hard *even if you do attend DefCon*, which notably, Amy does not. How this might occur - not Amy's fault ----- Businesses are liable for hacking, but it's impossible to do business when a wildly random set of circumstances could converge to bankrupt your company. So the credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards). This is a basic set of security rules and practices which *should* make hacking *unlikely*. Compliance is achievable (not easy), and if you do it, **you're off the hook**. That is one way Amy can be entirely not at fault. Or if you own a business, you know you get spammed constantly by salesmen who want you to switch your Visa-MC merchant service over to them. The salesman gets $600 commission when you switch. So Amy's all set, and even added that free WiFi you kept pestering her to add, which she zoned correctly relating to the credit card machines. And Joe Salesman keeps working her over, and she finally relents. The deal promises to use her existing machines, which are P2PE, so that's all set. *Oh wait.* Unbeknownst to Joe, those machines *don't* work, but that's OK, the company provides her new machines free (they're not P2PE), and sends out Doofus Bitboy to install them. Well, Doofus knows nothing about PCI-DSS but was told how to fake the paperwork. The secure WiFi's SSID isn't advertised and Doofus can't even find it, so he sticks the machines on the public WiFi. *You see where this is going.* The DSS audit confirms Amy had been lied to, and they go after Doofus and the scumball processor who told him how to fake paperwork Did you follow all that tech talk? No? Neither does Amy, and neither *can any small business owner honestly be expected to*. Like Amy they have to rely on their vendors. Allowing that scumbag processor to *be* a processor is Visa/MC's fault. **This is just a super-hard problem: getting regular humans with life-consuming business-owner jobs to do what it takes to stop fraud, without breaking their backs with risk or complexity.** And this is part of the drive toward chip cards and self contained P2PE terminals. Our business dodges PCI-DSS by using our ticketing service's merchant account (at a 1% premium) and PayPal Here (P2PE in the wedge) for face to face transactions. The P2PE takes all our tablets, phones and networks out of PCI-DSS scope. So back to your desire to know it's Amy's Waffles. **How does that help the fraud problem?** It doesn't. It's a need to know: you don't. Worst case you blow Amy up on social media unfairly. That deters the business next door to voluntarily report their trouble, and they cover it up. That business is having enough problems without you dogpiling on. ----- Right off the bat, who do you think paid for that replacement credit card? Bingo. $50 per customer right there. Plus - the initial cost of a PCI-DSS audit (even if they were innocent) - huge fines if they weren't - the actual cost of re-engineering their systems and procedures to be actually compliant - get re-certified the hard way (since they are now untrusted). - the cost of being unable to take credit cards while all this is sorted - the cost of having any credit card revenue in the pipeline "on hold" until all fraudulent transactions are sorted - oh yeah, ***and all the fraudulent transactions***. So even if they're a hot dog vendor, they could be paying for a lot of leather coats and iPhones. The simple fact is 80% of businesses in this situation go bankrupt at this point. *You'll know who they are, when they fold up.* Just the cash flow impacts of losing current and recent credit card transactions will finish off a lot of businesses that are just making it hand-to-mouth. It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution. Often you see binary businesses like the baseball park and its contract vendor who runs all the concessions, where most poeple end up doing business with both. So they may not know, and telling you would be *defamation.*