Are POS terminals at the point of sale being hacked? How secure is credit card data?

if the pos is an old model replace it get a new device. ask the company about pci-dss compliance, they know. keep card data encrypted, truncate receipts (show 1234, hide the rest). do firmware updates regularly...

PCI-DSS requirements: 1) Network segmentation (POS → Payment network), 2) Firewall rules (POS-only ports), 3) Encryption (AES-256, TLS 1.2+), 4) Access control (strong password, key management), 5) Vulnerability scanning (quarterly), 6) Intrusion detection, 7) Data retention (minimized), 8) Incident response plan. Terminal software: check Verifone, Ingenico firmware updates. Tokenization: payment processor manages tokens, don't store card numbers in POS memory. Offline mode risk: batch settlement delays, high chargeback risk.

don't use the old POS 2024 EMV terminals are very cheap. if you're going to do PCI-DSS compliance, ask your payment processor, they'll help too. keep card data encrypted, tokenized — the real number shouldn't appear anywhere. if you sell the device you'll do a secure wipe, get a warranty certificate...

POS security layers: 1) Hardware (tamper-proofing, secure boot), 2) Software (signed OS, verified updates), 3) Communication (TLS 1.2+, certificate pinning), 4) Data (encryption, tokenization, key management), 5) Compliance (PCI-DSS self-assessment, SAQ, audit). Transition: old POS → new POS, data migration (wiping the old device). Incident: card breach → PCI notification, breach disclosure, forensic investigation.

20 years managing POS systems, biggest mistake is using old hardware. Old terminals don't get firmware security patches, making them malware targets. New terminal (chip + contactless, tokenized) + proper VLAN + PCI audit = safe. If you don't store card data on the machine, you won't be a hacker target.

I have no experience with pos terminal security so I'm asking. If permission and scope aren't in writing don't start that test.

Of course it varies if your situation is different.

i felt relieved reading this answer, so it's not just me. like taking measures without an inventory leaves doors you haven't seen open.

when making a decision first look at what data you have on hand.

The opposite happened to me, that's why I'm writing. Hasty decisions become decisions you have to fix six months later.

Just leaving this note, it might be useful.

Let me summarize the topic, since several different answers were given. If permission and scope aren't in writing, don't start that test.

If I were you, I'd go this route.

Good call starting this thread.

We need to take it step by step. Any unwritten clause becomes a point of disagreement later as both sides remember it differently.

I'd appreciate it if you shared the outcome.

I have a question. An untested backup is not a backup.

An automated scan report is not the same as a penetration test. Proven by experience.

Saved.

Let me share what happened to me; it might be useful. If you don't write this down from the start, it leads to arguments later.

That's all, sorry if I went on too long.

We got stuck at the same point for a while. tbh an automated scan report is not the same as a penetration test.

I'm also curious if anyone does it differently.

I'm a small business, let me explain from my side. Solutions that work at a small scale collapse when you grow; I learned this late.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. I'm also curious if anyone does it differently.

let me share what happened to me; it might be useful. solutions that work at a small scale collapse when you grow; I learnned this late.

just leaving this note, it mgiht be useful.