1

Can the data be easily intercepted when (or after) the card is swiped? My main concern is at a trusted vendor. There are two possibly different situations:

1) a typical point of sale scanner with a land line or internet connection

2) a standard reader on a smart phone, using the supplied software

Does the typical system usually store the credit card number or does it merely transmit it to the verification center? Are these transmissions encrypted?

edit: I am only concerned with mag strip readers and client side security (server security is a whole different issue). I didn't mention camera or shoulder surfing as concerns because those threats are always a possiblity. How secure is my card number and PIN after they are entered into the device?

closed as too broad by Adi, Xander, Gilles, TildalWave, NULLZ Jan 2 '14 at 2:37

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What kind of credit card readers? Mag stripe, chip, or contactless? Are you concerned about privacy (credit card number) or confidentiality (PIN)? Are you concerned about attacks in transmission, attacks with physical presence (e.g. hidden camera), software attacks? – Gilles Jan 1 '14 at 15:31
2

It depends, but where there's a will, there's a way.

You're asking a few different questions here:

  1. Do POS terminals always encrypt the data they send? (No; as per DSS 4, data must be encrypted across public networks, so if the POS terminals are dead-ending to a server within the store, they may not need to encrypt. This has been shown as a real-world security concern in multiple cases. Isn't this how Home Depot got slammed a few years ago?)

  2. Does a reader attached to a smart device always encrypt? (I don't believe that's a requirement, although the PCI guidance on "Accepting mobile payments with a smartphone or tablet" implies that any Council-approved device will, and if you choose to use unapproved devices you just bought into a whole lot of scope you need to vet. Have fun proving the smartphone never, ever sends data unencrypted if the scanner hasn't already guaranteed it!)

  3. Is a POS terminal at a trusted merchant trustworthy? (No. Consider what happened to Barnes & Noble. Bear in mind that POS terminals are programmable devices - I have heard legends of one sales guy for a card processor who went around "updating" terminals at local businesses - to point to his processor instead of the processor the business was contracted with! Also consider the problems banks have with ATM skimmers.)

To quote Mad-Eye, this stuff requires "constant vigilance!" I don't know what a typical system does; there's a lot of systems out there. A good system would encrypt before transmission and be resistant to various forms of tampering, but no system is perfect.

Not the answer you're looking for? Browse other questions tagged or ask your own question.