Visa has received an increasing number of reports regarding POS PIN Entry Device (PED) ‘after-hours’ thefts from merchant store locations, with evidence indicating POS PEDs are being physically removed from their locations and are being replaced with ‘parasite’ pads that recorded the user’s card data. Surveillance revealed that suspects were able to remove and install a POS PED in under one minute. Any store that has deployed not tamper-evident or tamper-resistant older POS PEDs could be most affected by the tactic. Thieves targeted POS placed in supermarkets, drug stores and convenience stores. PEDs that are known to be targeted by criminals include VeriFone PINpad 101, 201 and 2000, VeriFone Everest model P003-3xx, Hypercom S7S and S8, and the Ingenico eN-Crypt 2400. In order to deal with fake PED problem, Visa has recommended merchants to monitor PED internal serial numbers, detect when PEDs are disconnected or removed and also physically secure PEDs. Merchants are advised to purchase only PCI- approved PEDs that have been lab-evaluated. Visa regulations and operating rules require that PEDs deployed by members and their agents comply with payment card industry PED security requirements. Merchants are advised to create a plan that ensures all deployed POS PEDs are Visa-approved, lab-evaluated and comply with the triple data encryption standards by July 2010. Also, Visa encourages companies to train employees in relation with the potential PIN compromise in stolen or missing POS PEDs cases. Merchants are advised to contact their merchant bank, law enforcement and Visa as soon as they suspect tampering of any POS PEDs.Vancouver police recently revealed parasite PEDs skim sites into Canadian cities Langley, Vancouver, Maple Ridge, Richmond, Coquitlam and Abbotsford, British Columbia. Two persons were arrested following Canadian police investigation.
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now