Pinpad Security Best Practices; Introduction; Administrative Security Activities - VeriFone MX 900 Series Reference Manual

7
This chapter contains information on PINpad security Best Practices for the
MX 900 Series terminals, the MX 915, and the MX 925.

Introduction

Retailers are facing a new and growing threat. Locked out of the payments chain
by EMV and encryption, today's criminals are now turning to the Payment Entry
Device (PED) itself.
Fraudsters can steal and re-engineer PEDs before re-installing them into retail
outlets, such as supermarkets and petrol stations, often conspiring with a staff
member. They can then capture and transmit card details and PINs to create
fake cards for use at home or abroad.
The negative publicity, damage and cost that can result from PED theft and
subsequent customer data fraud, is considerable. Indeed, the threat is so great
that some retailers have already received a recommendation to improve
physical PED security by tethering and locking their PED assets.

Administrative Security Activities

1. Develop a process to monitor devices that consistently do not work
2. Institute a procedure to track each instance in which a terminal is
3. Implement a procedure to require all repair technicians who visit your
4. If the PIN pad supports electronic serial numbers, implement a scheme
September 14, 2012
PIN S
PAD
properly, such as high read failures or debit card declines. These can be
indicators of tampered terminals.
replaced within the store, whether from the in-store inventory, by a
repair technician, or with units shipped into the store.
stores to sign in, verify their identity with photo identification, and
remain accompanied by store personnel during any work on PINpads.
to validate the PIN pad serial number every time the POS starts up to
insure the device has not been replaced, and if it has, automatically
send an alert.
B
ECURITY
P
EST RACTICES