VeriFone MX 880 Installation Manual page 36

30
MX 800 S I
ERIES NSTALLATION
3
Change the default PINpad password.
Make sure the password for device access is not the original default
password. If it is, have it changed, as default passwords become widely
known. Contact your account executive if you need help changing this
password.
4
Monitor PINpad payment problems.
Develop a process to monitor devices that consistently do not work properly
such as high mag-stripe read failures or debit card declines. These can be
indicators of tampered terminals. Contact the security officer at the terminal
manufacturer to determine the next steps.
5
Check the accreditation/ references of any service technicians. Require they
show a photo ID and sign a service log.
Social engineering is sometimes employed to commit fraud; a fraudster acts
as a service technician or consultant to allow them to gain unauthorized
access. All service technicians should be required to show a photo ID and
sign a service log. The details of the visit should be communicated in
advance to the manager or cashier by management.
6
Use and retain accurate shift schedules so that a staff audit trail is available.
Schedules of "what staff worked when" should be maintained to help with any
investigations or enquiries that may arise at a future date. This will also act as
a deterrent to staff to commit fraud as they are accountable for their actions.
7
Periodically audit the service log.
Establish and maintain a service log that records the who/what/where/when/
why of a technician visit should be periodically audited by management to
ensure that all servicing was approved.
8
Check repair technician verification and log service activities.
Implement a procedure to require all repair technicians who visit your stores
sign in, verify their identity with photo identification, and remain accompanied
by store personnel during any work on PINpads.
9
Store PINpad and payment terminals in a secure location.
Store all spare devices under lock and key to prevent unauthorized removal.
Incorporate a procedure to validate the devices inventory at every shift and
make sure none have disappeared.
10
Track terminal assets as they move in and out of Inventory.
Institute a procedure to track every time a terminal is replaced within the
store, whether from the in-store inventory, by a repair technician, or units
shipped into the store
G
UIDE