Jun 25, 2026 · 38 min · 11 segments
In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, explore some of the most misunderstood areas of PCI DSS…
Tibor LaczkoGuest
Alistair StewartGuestAnnieHostSo my first question for you guys is, what is the simplest way to determine whether an organization is a service provider or a merchant if the payment flow is indirect?
But I think an even simpler question is, have you been assigned a merchant ID by your acquirer? If you are, if you have a merchant ID, the name is in the, you know, it's on the 10, you are a merchant.
If you do not have a merchant ID, that means whatever service you provide is in service of a merchant, i.e. you're a service provider.
But, yeah, it trips up a lot of people because especially for me, again, in the last few weeks was I don't see cardholder data.
I cannot be a service provider because I don't service cardholder data, but again, Do you have a merchant ID?
Do your customers have merchant IDs? Are you doing something in relation to those? So if they can't find merchant IDs, I go, well, look at where the money goes.
So when a card transaction happens, money leaves a customer's account and it hits a business account.
Anybody else involved in assisting or protecting that transaction is therefore by default service provider.
So it's follow the money first and then go, what are we doing that relates to that particular transaction?
And sometimes even a service provider can take this a step further and say like, oh, we are being paid for services.
But then again, the question goes back is what services are you being paid for and by whom? So the fact that you get money, obviously, good for you.
Yeah, and being a service provider doesn't preclude you being a merchant as well and vice versa.
You can be a service provider for the services you provide to your clients and a merchant for the payments you take for your services if you take payments via credit or debit cards for those services.
So my first question for you guys is, what is the simplest way to determine whether an organization is a service provider or a merchant if the payment flow is indirect?
But I think an even simpler question is, have you been assigned a merchant ID by your acquirer? If you are, if you have a merchant ID, the name is in the, you know, it's on the 10, you are a merchant.
If you do not have a merchant ID, that means whatever service you provide is in service of a merchant, i.e. you're a service provider.
But, yeah, it trips up a lot of people because especially for me, again, in the last few weeks was I don't see cardholder data.
I cannot be a service provider because I don't service cardholder data, but again, Do you have a merchant ID?
Do your customers have merchant IDs? Are you doing something in relation to those? So if they can't find merchant IDs, I go, well, look at where the money goes.
So when a card transaction happens, money leaves a customer's account and it hits a business account.
Anybody else involved in assisting or protecting that transaction is therefore by default service provider.
So it's follow the money first and then go, what are we doing that relates to that particular transaction?
And sometimes even a service provider can take this a step further and say like, oh, we are being paid for services.
But then again, the question goes back is what services are you being paid for and by whom? So the fact that you get money, obviously, good for you.
Yeah, and being a service provider doesn't preclude you being a merchant as well and vice versa.
You can be a service provider for the services you provide to your clients and a merchant for the payments you take for your services if you take payments via credit or debit cards for those services.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
