EFTPOS Security: Protecting Your Business

As Australia moves closer to becoming a cashless society, the security of payment solutions has never been more critical. With most retail transactions in Australia now made by card or mobile wallet, EFTPOS terminals are a primary target for sophisticated fraudsters. For small and medium businesses, a single security breach can lead to devastating financial loss and irreparable brand damage.

Understanding the Threat: Skimming and Shimming

Physical security is the first line of defense. 'Skimming' involves the attachment of a device to a terminal to capture card data, while 'shimming' involves smaller devices inserted into the card slot itself. Australian business owners should conduct daily physical inspections of their EFTPOS hardware.

Look for broken security seals, loose parts, or mismatched colors on the terminal casing. In high-traffic areas like Westfield shopping centers or busy airport terminals, these checks should happen at the start and end of every shift. If a terminal looks tampered with, take it out of service immediately and contact your provider.

PCI DSS Compliance in Australia

The Payment Card Industry Data Security Standard (PCI DSS) is a global standard, but in Australia, it is strictly enforced by major banks like Commonwealth, Westpac, and ANZ. Being PCI compliant means your business follows best practices for handling, storing, and transmitting credit card information.

Modern EFTPOS terminals provided by KBServices are PCI-PTS (PIN Transaction Security) compliant, ensuring that PIN entry is encrypted at the point of interaction. However, compliance also involves how you handle your internet connection. Never run your EFTPOS terminals on the same public Wi-Fi network you offer to your customers. Use a dedicated, firewalled network to prevent 'man-in-the-middle' attacks.

The Rise of Refund Fraud

A common scam currently affecting Australian retailers involves 'refund fraud.' This is where an individual gains access to an EFTPOS terminal and processes a refund to their own card. To prevent this, ensure that your terminals are password-protected for all refund transactions. Only authorized managers should have the ability to process returns. Additionally, always reconcile your daily settlement reports against your POS records to spot discrepancies early.

Staff Training: Your Best Defense

Your employees are your greatest asset and your biggest vulnerability. Train your staff to never leave terminals unattended and to be wary of individuals claiming to be 'technicians' who haven't been pre-booked. Genuine technicians from companies like KBServices will always have identification and a formal service ticket.

Security is an ongoing process, not a one-time setup. By choosing the right payment solutions, you protect your revenue and your reputation. For expert advice on secure payment hardware, reach out to the team at KBServices. We provide secure, reliable hardware and support for businesses nationwide. Get a quote or contact us to learn more.