Also called: ADC Event, Account Data Compromise Event
What Account Data Compromise is
An Account Data Compromise is a card-network event involving unauthorized access to, disclosure of, or misuse of payment account data. Mastercard also defines a potential ADC event as an occurrence that could lead to unauthorized access or disclosure. The data in scope includes cardholder names, account numbers, expiration dates and, under Mastercard rules, security data such as PINs and card verification codes.
ADC applies to payment card data, not general bank-account or ACH data. Visa's rules cover suspected or confirmed access to Visa payment data, including unauthorized access to a system that stores, processes or transmits it. Affected merchants and their service providers can become involved in network investigations.
ADC is a card-network event with hard reporting deadlines, and missed deadlines can add costs to the incident.
Report the event on the network's clock
The reporting deadlines differ by network. Visa requires a report within 3 calendar days after you discover evidence sufficient for reasonable suspicion or confirmation, followed by an Incident Report within 3 calendar days after notifying Visa. Visa also sets a 3-day deadline for providing known or suspected compromised account numbers in specified circumstances.
Mastercard requires notification within 24 hours of awareness, preservation of relevant information within 24 hours, and known or suspected affected account numbers within 72 hours. Mastercard can require a PCI Forensic Investigator (PFI), with a preliminary report due within 5 business days after the investigation starts and a final report within 10 business days after it ends.
What an ADC event can cost
These are network assessments and investigation costs, not a standard monthly processing fee. As of 2026, Visa's schedule lists Level 3 merchant assessments of $5,000, $10,000 or $25,000 across annual transaction bands up to 1 million transactions. Visa can raise the assessment to $100,000 at its discretion; the schedule lists $100,000 for Level 1 and Level 2 merchants.
As of 2026, Mastercard rules allow assessments up to $100,000 for each related PCI SSC requirement violation, and up to $25,000 per day for failures to follow ADC procedures. Visa's rules also authorize investigation-related charges when a required PFI investigation remains incomplete after 4 full calendar months: $10,000 per month for specified Level 1 and Level 2 investigations, or a $3,000 flat charge for Level 3 merchant investigations. Network rules assign responsibility; they do not specify a standard merchant-statement descriptor for an ADC charge.
How ADC differs from a data breach
A data breach is a broad description of unauthorized access to or exposure of information. ADC is a card-network event with specific reporting, investigation and financial-responsibility rules. One incident can be both a data breach and an ADC event, but the ADC process focuses on payment card data and network requirements.
What you can actually change
You cannot control whether a card network classifies an incident as an ADC event. You can reduce avoidable costs and escalation by meeting deadlines, preserving evidence and completing required investigations and remediation.
- Keep a written incident plan that identifies who reports to Visa or Mastercard and who preserves system logs.
- Track the 24-hour, 72-hour and 3-calendar-day deadlines from the moment your team becomes aware of a possible event.
- Maintain PCI DSS compliance and document security safeguards before, during and after an incident.
- Separate network assessments and investigation charges from ordinary processing fees when reconciling your statement.
- Name an incident lead. Assign one person to contact your acquirer and coordinate reporting as soon as you identify possible card-data exposure.
- Preserve the evidence. Secure system logs and related records immediately, since Mastercard requires preservation within 24 hours of awareness.
- Track every deadline. Record when the incident was discovered and calendar each network's reporting, account-data and investigation deadlines.
Frequently asked questions
Is an Account Data Compromise the same as a data breach?
No. A data breach is a broad term for unauthorized access to or exposure of information. ADC is a card-network event focused on payment account data, with network-specific reporting, investigation and assessment rules. A single incident can qualify as both.
How quickly do you have to report an ADC event?
The deadline depends on the network. Visa requires reporting within 3 calendar days after you discover evidence sufficient for reasonable suspicion or confirmation. Mastercard requires notification within 24 hours of awareness and affected account numbers within 72 hours.
Does an ADC event create a standard fee on your processing statement?
No standard merchant ADC line or recurring fee is specified in these network rules. An event can lead to investigation costs or network assessments, including Mastercard assessments up to $100,000 per related PCI SSC requirement violation as of 2026.