PCI Forensic Investigator (PFI)

PCIComplianceHub · Last updated 22 September 2026

A company qualified by the PCI Security Standards Council to investigate suspected payment card data compromises. After a breach, a payment brand or acquirer typically requires the affected entity to engage a PFI, which determines how the compromise occurred, what account data was exposed, and whether the entity was compliant at the time. The resulting report goes to the payment brands and the acquirer, not only to the entity that commissioned it.