# Terminal Security
Source: https://paymentsandrisk.com/docs/fraud/terminal-security

Last updated 23 October 2026.

TL;DR

-   Daily terminal inspections are the single most effective thing you can do. Skimming devices go on and come off within 24-48 hours. A daily check catches them
-   Two attack vectors matter most. Physical security covers one: locked mounts, tamper-evident seals. Network segmentation covers the other, with terminals on their own VLAN
-   P2PE-validated terminals drop your PCI scope to SAQ P2PE. That's a big compliance win, and it's worth the hardware cost if you're Level 1, or if PCI is eating real time
-   Employee theft is uncommon, and it's the easiest of these to catch because the pattern shows up in your own reports. Limit keyed-entry permissions and audit high-value transactions separately

Someone wants the card data moving through your terminal, and they can get at it physically with a skimmer, a shimmer, or a swapped terminal. The other route is your network, where POS malware and stolen credentials do the same job. Most of it's preventable. Daily inspections, a segmented network, trained staff. If you only ever do one of those, do the inspection. This page covers the threats, the checklists, and the response.

## The Threat Landscape

```mermaid
flowchart TD
    subgraph Physical["Physical Attacks"]
        P1[Skimmers]
        P2[Shimmers]
        P3[Overlay devices]
        P4[Terminal swap]
    end
    subgraph Network["Network Attacks"]
        N1[POS malware]
        N2[Man-in-the-middle]
        N3[Credential theft]
    end
    subgraph Internal["Internal Threats"]
        I1[Employee tampering]
        I2[Social engineering]
    end

    Physical --> D[Card Data<br/>Compromise]
    Network --> D
    Internal --> D

    style D fill:#b42318,color:#fff
```

### Attack Types by Frequency

| Attack | How Common | Detection Difficulty | Typical Loss |
| --- | --- | --- | --- |
| **Skimmers/overlays** | Common | Medium (visual inspection) | High |
| **POS malware** | Common | Hard (no visible signs) | Very High |
| **Employee theft** | Uncommon | Easy (patterns visible) | Medium |
| **Terminal swap** | Rare | Medium | High |
| **Shimmers** | Growing | Hard (hidden inside) | High |

* * *

## Physical Attacks

### Skimmers

**The attack:** A device sits over or near the card slot and captures magnetic stripe data on every swipe.

**Types:**

| Type | Where Installed | What It Captures |
| --- | --- | --- |
| **Overlay skimmer** | Over card slot | Mag stripe data |
| **Pinhole camera** | Near keypad | PIN entry |
| **Keypad overlay** | Over keypad | PIN entry |
| **Internal skimmer** | Inside terminal | Mag stripe data |

**Detection:**

```text
Daily terminal inspection:
□ Wiggle the card slot - is it loose or different?
□ Check for unusual bumps or additions
□ Compare to a known-good terminal photo
□ Look for tiny holes (camera placement)
□ Feel the keypad - does it seem thicker?
□ Check for anything blocking the tamper labels
```

### Shimmers

**The attack:** Paper-thin devices go INTO the chip slot, where they intercept chip card data.

**Why they're dangerous:**

-   Not visible from outside
-   Can capture chip data
-   Only detected by card reading issues

**Detection:**

-   Cards feel tight or don't insert smoothly
-   Increased chip read failures
-   Look inside slot with flashlight

### Terminal Swap

**The attack:** An attacker swaps your terminal for a modified one that looks identical, isn't, and captures everything.

**Prevention:**

-   Secure terminals physically (bolts, cables)
-   Serial number inventory
-   Tamper-evident seals
-   Regular serial number verification

* * *

## POS Malware

POS malware reads card data out of terminal memory, before encryption ever touches it.

### How It Works

```mermaid
flowchart LR
    A[Card swiped] --> B[Data in memory<br/>briefly unencrypted]
    B --> C[Malware captures]
    C --> D[Exfiltrates data]
    B --> E[Normal processing]

    style C fill:#b42318,color:#fff
```

**The vulnerability window:** The card gets swiped, and for a moment the data sits unencrypted in terminal memory before it moves on to the processor. Malware grabs it in that gap.

### Common POS Malware Families

| Malware | How It Spreads | What It Does |
| --- | --- | --- |
| **Backoff** | Remote access exploit | Memory scraping |
| **PoSeidon** | Phishing, weak RDP | Memory scraping + keylogging |
| **RawPOS** | Supply chain, infected updates | Memory scraping |
| **TreasureHunter** | Phishing | Memory scraping, exfiltration |

### How Malware Gets In

| Vector | How to Prevent |
| --- | --- |
| **Weak remote access** | Disable RDP, use VPN, strong auth |
| **Phishing** | Employee training, email filtering |
| **Supply chain** | Verify software sources, signed updates |
| **Weak passwords** | Strong credentials, no defaults |
| **Unpatched systems** | Regular patching |

* * *

## Prevention: Network Security

### Segment Your Payment Network

**Payment terminals should be on their own network segment:**

```text
Internet
    |
[Firewall]
    |
├── Corporate network (workstations, email)
└── Payment network (terminals only)
        |
    [Payment terminals]
```

**Why this matters:**

-   Malware on a workstation can't reach terminals
-   Limits lateral movement
-   Easier to monitor

### Terminal Network Rules

```text
Payment network segment rules:
□ No internet access except to processor IPs
□ No inbound connections from corporate network
□ No peer-to-peer between terminals (usually)
□ Logging all traffic in and out
□ Whitelist only necessary ports (usually 443)
```

### Secure Remote Access

If terminals need remote management:

| Do | Don't |
| --- | --- |
| VPN with MFA | Direct RDP exposure |
| Whitelisted IPs | "Open to internet" |
| Session recording | Unmonitored access |
| Individual accounts | Shared credentials |

* * *

## Prevention: Physical Security

### Terminal Placement

| Placement | Risk Level | Why |
| --- | --- | --- |
| Fixed, visible counter | Low | Staff can monitor |
| Fixed, low visibility | Medium | Harder to watch |
| Mobile (customer hands) | Medium | Out of sight briefly |
| Unattended (kiosk) | High | No supervision |

### Physical Controls

```text
Physical security checklist:
□ Terminals bolted or cabled to counter
□ Tamper-evident seals on terminal housing
□ Serial number documented and verified
□ Daily visual inspection (opening, closing)
□ Surveillance camera covering terminal
□ Staff trained on what to look for
```

### Tamper Detection

Most modern terminals have tamper detection:

-   Opens housing = terminal bricks
-   Movement detection alerts
-   Mesh protecting internals

**Check:** Is your terminal's tamper detection enabled and monitored?

* * *

## E2EE vs. P2PE

Both encrypt card data at the terminal. The difference is validation and scope reduction.

### E2EE (End-to-End Encryption)

**How it works:** The terminal encrypts the card data before it ever hits your network. You can't decrypt it.

**Limitation:** Not validated by PCI SSC. Doesn't automatically reduce PCI scope.

### P2PE (Point-to-Point Encryption)

**How it works:** E2EE, validated by the PCI Security Standards Council.

**Benefit:** A validated P2PE solution cuts your PCI scope hard. SAQ P2PE instead of SAQ D.

### Comparison

| Factor | E2EE | P2PE (validated) |
| --- | --- | --- |
| Encryption at terminal | Yes | Yes |
| You can decrypt | No | No |
| PCI SSC validated | No | Yes |
| Scope reduction | Maybe | Guaranteed |
| Cost | Lower | Higher |
| Device options | More | Fewer |

**Recommendation:** P2PE validation is worth the premium if you're Level 1. Same if PCI is eating real time.

See [E2EE vs P2PE](https://paymentsandrisk.com/docs/payments/reference/e2ee-vs-p2pe/) for detailed comparison.

* * *

## Employee Training

Your staff are your first line of defense. They're also the threat. That's why keyed-entry permissions get limited and high-value transactions get audited separately.

### What Staff Should Know

```text
Staff training checklist:
□ How to inspect terminals (daily)
□ What skimmers and overlays look like
□ Who to report suspicious activity to
□ Never let unknown technicians access terminals
□ Verify technician identity (call company directly)
□ Don't plug unknown USB devices into POS systems
□ Report unusual terminal behavior
```

### Social Engineering Red Flags

| Scenario | Red Flag |
| --- | --- |
| "I'm from \[processor\], here to update your terminal" | Unscheduled visit |
| "I need to install this update on your register" | Unknown software |
| "Give me your terminal to check something" | Taking terminal away |
| "I need your admin password to fix an issue" | Password request |

**Rule:** Verify every technician by calling your processor or vendor directly. Use a number you already have, not the one they hand you.

* * *

## Incident Response

### Signs of Compromise

| Signal | What It Might Mean |
| --- | --- |
| Cards getting declined that usually work | Terminal issue or tampering |
| Customer complaints of fraud after visiting | Card data stolen at your location |
| Card brand notification of fraud cluster | Common Point of Purchase (CPP) identified |
| Terminal behaving strangely | Possible malware |
| Unknown network traffic from payment segment | Exfiltration attempt |

### If You Suspect Compromise

```text
Immediate actions:
□ Stop using the suspected terminal
□ Preserve evidence (don't wipe or reset)
□ Document everything observed
□ Contact your processor
□ Check other terminals for similar issues
□ Review recent transactions for patterns
□ Start Breach Response if confirmed
```

See [Breach Response Playbook](https://paymentsandrisk.com/docs/playbooks/breach-response/) for full incident response.

* * *

## Terminal Inspection Checklist

Use this daily (opening and closing):

```text
Visual Inspection:
□ Terminal looks same as yesterday?
□ No new devices attached?
□ Card slot feels normal?
□ Keypad feels normal thickness?
□ No unusual holes or additions?
□ Tamper seals intact?
□ Serial number matches inventory?
□ Cable connections secure?

Functional Check:
□ Terminal powers on normally?
□ Test transaction works?
□ No unusual screens or messages?
□ Receipts printing correctly?
```

**Tip:** Photograph your terminals and keep the photos somewhere secure.

* * *

## Test to Run

**Terminal security audit (monthly):**

```text
Network:
□ Are terminals on segmented network?
□ What IPs can terminals reach?
□ Is remote access secured (VPN, MFA)?
□ When was terminal software last updated?

Physical:
□ Are terminals physically secured?
□ Are tamper seals in place and intact?
□ Serial numbers match inventory?
□ Staff trained on inspection?

Encryption:
□ What encryption method (E2EE, P2PE)?
□ Is it working (test transaction)?
□ When were encryption keys last rotated?
```

* * *

## Scale Callout

| Business Type | Focus |
| --- | --- |
| **Single location, staffed** | Daily inspection, basic network hygiene |
| **Multiple locations** | Centralized monitoring, regular audits, standardized config |
| **Unattended terminals (kiosks)** | Heavy physical security, cameras, more frequent inspection |
| **High-value transactions** | P2PE, network segmentation, enhanced monitoring |
| **Franchise/distributed** | Training consistency, compliance verification, audit program |

* * *

## Where This Breaks

1.  **Unattended terminals.** Kiosks and unattended payment points are high-risk. Physical security, cameras, and frequent inspection are essential.

2.  **Third-party access.** Technicians, cleaners, and delivery people can all access terminals. Verify identities and supervise access.

3.  **Old terminals.** Legacy terminals may lack tamper detection, encryption, or security updates. Replacing them is cheaper than the breach.

4.  **Franchisee compliance.** A franchisor owns the brand risk. Your franchisees' terminal security is part of it, so audit and enforce.


* * *

## Next Steps

**Basic security?**

1.  Implement daily inspection → Use the checklist above
2.  Segment your network → Isolate payment systems
3.  Train your staff → What to look for, who to call

**Upgrading security?**

1.  Evaluate P2PE → [E2EE vs P2PE](https://paymentsandrisk.com/docs/payments/reference/e2ee-vs-p2pe/)
2.  Add monitoring → Network traffic, terminal health
3.  Regular audits → Monthly using the checklist

**Had an incident?**

1.  Start breach response → [Breach Response Playbook](https://paymentsandrisk.com/docs/playbooks/breach-response/)
2.  Preserve evidence → Don't reset or wipe
3.  Contact processor → They'll guide investigation

* * *

## See Also

-   [Card-Present Fraud](https://paymentsandrisk.com/docs/fraud/card-present-fraud/) - CP fraud patterns
-   [Card-Present Terminal Decisions](https://paymentsandrisk.com/docs/payments/card-present-terminal-decisions/) - Choosing terminals
-   [E2EE vs P2PE](https://paymentsandrisk.com/docs/payments/reference/e2ee-vs-p2pe/) - Encryption comparison
-   [PCI DSS Compliance](https://paymentsandrisk.com/docs/compliance/pci-dss/) - Compliance requirements
-   [Breach Response Playbook](https://paymentsandrisk.com/docs/playbooks/breach-response/) - Incident response
-   [Terminal Operations](https://paymentsandrisk.com/docs/operations/terminal-operations/) - Day-to-day terminal management
-   [Processor Management](https://paymentsandrisk.com/docs/operations/processor-management/) - Working with your processor