Card Terminal Security Settings to Check

Why the terminal deserves cash-drawer controls

Most owners lock the cash drawer and count it at the end of a shift, but leave the card terminal on its default settings. A terminal can send money back to a card through a refund, can be reconfigured from its menus, and can be swapped for a look-alike device. The PCI Security Standards Council's information supplement on skimming prevention, published for merchants in September 2014, describes cases where criminals swapped good terminals for compromised ones, or installed malware while posing as a service technician. Simple settings and habits close most of these gaps.

Know every device you have

Start with a list. For each terminal and PIN pad, record the location, the make and model, and the serial number, and note how it is normally connected. The PCI guidance suggests photographs to confirm the terminal and its serial number, and recording the number and type of connections each terminal normally has. With the list in hand, inspect devices for tampering or substitution on a routine, which the guidance says could be once a day or at the beginning of each shift. Check that the serial number on the label matches the one on screen, and look for added parts, loose casing or extra cables. Rotate who does the check, as the guidance recommends.

Lock down settings and passwords

The PCI guidance says to protect access to administration and configuration menus and to never use default or common passwords. In practice, ask your provider which settings on your terminal can be locked behind a password, then change any password the device shipped with. Give managers their own credentials instead of one shared code, and remove access when someone leaves. If your terminals connect over Wi-Fi or Bluetooth, the same guidance says to control access to wireless routers, passwords and network names.

The wider security picture: PCI compliance basics

Put refunds and voids behind approval

A refund is money leaving your account, so treat it like a cash payout. Require a manager password or approval for refunds and voids, and for any refund to a card that was not used for the original sale if your system allows that at all. Review refunds by employee every day or every shift. A refund with no matching sale, or many small refunds from one login, is worth a question the same day rather than at month end. Know the difference between a void and a refund on your system, because they settle differently.

How they differ: Refunds vs voids: what the card rules require

Service visits and replacement terminals

The PCI guidance is direct: do not allow unannounced service visits or accept unannounced upgrades, of hardware or software, without checking with your service provider. If a service visit is needed, agree a date and time in advance and, if possible, confirm the name of the person coming. If someone arrives unannounced, do not give them access to any terminal until you have confirmed their identity with the vendor or service company. Treat a replacement terminal sent by mail the same way: confirm it with your provider through a contact you already have, not one printed on the package. Tell staff this rule in plain words, because they are the ones at the counter when someone says they are here to fix the reader.

If something looks wrong: If you suspect a card data breach: what to do first

What changes for small, mid-size and enterprise businesses

A small business with one or two terminals can keep the device list on one page, check the devices when the shift opens, and keep refund approval with the owner. A mid-size business with several registers needs named logins for each staff member, a refund report reviewed by a manager, and a written rule for service visits that every shift knows. Multi-location and enterprise operations need the same controls applied the same way everywhere: one device inventory across locations, the same password and refund settings on every terminal, ideally set centrally through the provider's terminal management tools, a schedule for inspections with a record of who checked what, and an incident plan that names who to call. The PCI guidance notes that criminals have stolen terminals, compromised them, and returned them to the same store or another store in the same chain, so a chain-wide inventory matters.

Check your setup with us

CELER Merchants is an independent agent, not a processor. Send us a recent statement and tell us which terminals you use, and we will point out the settings worth asking your provider about, along with a plain-English read of your fees. The review is free and there is no obligation.