How can a customer authenticate EPOS device and make sure it's not fake?

Question

In the scenario where customers use magnetic stripe payment cards and are paying via EPOS, a merchant can put a fake EPOS on the table that looks identical to real ones, the customer uses his card on this device and enters his pin.

This device records card information and the pin entered and says that it failed to connect to the bank or the payment gateway.

Then the merchant tells the client to use another EPOS which is genuine and the payment succeeds. It's like phishing but in real world with physical devices.

In this scenario there's no way for the customer to authenticate this EPOS device and make sure that it's the real device and connected to bank network.

Are there any methods currently being used to mitigate this risk? What are some countermeasures to put in place, not to fall for this attack?

(reminder) these devices are tamper resistant meaning you can't open them up and manipulate the circuitry but the scenario above, uses a totally fake device that just looks like real EPOS devices.

Answer 1

Switch from magstripe to chip cards

The only way for preventing a fraudulent merchant or POS from impersonating a customer/card is by ensuring that the card data cannot be copied and cloned by the merchant simply by having the card available during a normal payment process. The switch to EMV chip cards was intended as a solution for this and other problems.

The scenario that you describe is very similar to other popular attacks like a third party attaching a skimming device (e.g. on ATMs) or a dishonest waiter swiping a card in a real terminal and also another card reader. The customer can spot such risks in some cases, but in general they cannot eliminate the risks, cannot do a full validation and will have to trust the merchant and accept some risk or not use magstripe payment cards.

The main practical way for fighting this type of fraud is by identifying common point of purchase after fraud has happened, and verifying identities of potential merchants - so that it becomes impractical to do this because you're very likely to get caught soon, and it's not that easy for such criminals to recreate new legit merchant connections many times.