Ailsa Bates examines the reasons for the growing trend to secure card readers at point of sale. The PR disaster suffered by US retailer Target the period following Black Friday flagged up the contined attraction to criminal elements of the card reader
Security measures to protect electronic payments from online fraud grab the headlines but card payment machines in the ‘real’ world can be just as vulnerable to criminal activity. The recent news about a skimming scam at Target stores in December 2013 highlights that this problem is not going away. Criminals are simply adapting, making this a live issue for retailers around the world.
Go deeper with GlobalData
For Target, malware may be the primary culprit although at the moment it’s not clear how the software found its way onto the card payment machines, and whether this was by direct addition of a chip to the machines or through the network. The result however, is crystal clear: the theft of 40 million customers’ data in a black Friday sting which had a huge impact on the retailer’s perceived level of trust with customers and leaves it facing a number of lawsuits.
The card reader remains a hot target for criminals, who are finding a host of ways to steal customer data. This can be as simple as looking over the shoulder to see another shopper’s PIN (shoulder surfing), adding a chip to the card machine or installing malware to acquire customer data (skimming), to stealing and substituting the card reader itself.
Skimming has been happening since card payment machines began but advances in technology gave retailer’s hope that the problem could be resolved. This was a false hope, as Target’s recent troubles attest.
There are two approaches to reducing the risk of data being stolen – protecting the software by employing good network security and protecting the hardware by ensuring no one can gain access to the back of the card payment machine or steal it. Ideally, the machine should be locked into position to protect it from interference.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataStolen machines are valuable and can be resold on the black market but this is not where criminals make the big bucks. The theft of card data and PIN numbers can represent hauls into millions of dollars for the perpetrators.
PCI compliance also holds the merchant responsible for keeping customers’ data secure so the retailer can potentially face loss of customer trust, the PR nightmare of having to announce the breach and also be hit with legal action from legislators as well as their customers.
There is far less risk of this happening if the payment machine is secured in place with a mount. A lockable mounting device where the card machine can only be removed with considerable mechanical force lowers the risk, combined with network management tools which allow the devices on the network to be monitored for any unusual activity.
Determined criminals have been known to try colluding with store staff to get around security measures. Merchants can prevent this by installing lockable bases for the card machines and limiting the number of staff who hold keys. Regular checks can help ensure that the correct number of machines are all present on the network.
A hologrammed security sticker which shows clearly if the seal is intact can be useful to indicate the machine has not been tampered with and is still secure. Spare machines in storage should be securely locked away and accounted for, with care taken to ensure they are not accessible to casual staff or to the general public.
Card machine manufacturers use sensitive security systems which shut the machine down and wipe data if they detect activity that could indicate a ‘tamper’.
This is a valuable way to protect customer information from genuine attacks, but a false tamper can be costly to the retailer, as the machine generally needs to be replaced. Mounting the machine reduces handling by customer and checkout staff, and the incidence of false tampers.
Mounting also reduces the wear and tear on the machine and its cable as it’s passed backwards and forwards to the customer and extends the life of the machines.
So, there are so many good reasons for mounting the card reader as securely as possible in the store.
And the peace of mind retailers gain knowing that they are protecting their customers is just as important as the financial benefits gained from extending the lifespan of the payment technology.
Ailsa Bates is Marketing Director of Tailwind Solutions
About Tailwind
Tailwind Solutions is a Scottish based company specialising in retail Point of Sale (POS) and with particular expertise in the card payments market.
Its founders, Garry Knox and Mark Stewart previously held senior executive positions with Ingenico where Garry headed up Product Marketing for the Northern European territory and Mark was Head of Retail Sales and Business Development. Together they have close to 40 years experience in the card payments industry – technical, marketing, sales, business development and management.
Tailwind operates a strict Channel Partner model and is rapidly signing up new partners across the globe to promote and distribute its products.
