Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From time to time, our premises and infrastructure is rented temporally for some conventions/meetings. One of these meetings requires an ordinary POS which would require a phone line or internet broadband connection to connect to payment gateway.

My concern is, what would be our responsibility as owners of IT infrastructure that is being borrowed for this POS? and how can I protect ourselves from any incident related to cards transactions through that POS?

share|improve this question

Communication from the POS to the payment gateway should be encrypted. You do not have any access to the encryption keys. Hence it is impossible for you to get access to any card holder data.

Even if the traffic is not encrypted, those responsible for the POS would have to require you to provide a PCI DSS compliant network, for you to have any responsibility.

If card holder data is stolen, an investigation will try to find out where the data were stolen. If they're able to find a CPP (common point of purchase), and that the data were actually stolen from that merchant, the card brands will hold the acquiring bank responsible. Depending on the legal agreement between the merchant and the acquiring bank, the acquirer might fine the merchant.

Hope that helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.