How can I protect my point-of-sale system against security breaches?
Ask a question.
Dear Your Business Credit,
I have heard that the point-of-sale system at my store could be breached if I don't have the right kind of password. What should I do to make sure it is secure? -- Steven
This is a great question. Many small business owners are at risk of a breach at the point of sale and don't know it. Verizon's 2014 Data Breach Report found that 14 percent of incidents in 2013 were point-of-sale (POS) intrusions. Most victims discover their system has been breached after they are told by someone else, such as law enforcement.
A breach can cost your business money, especially if you don't detect it quickly. If a credit card issuer traces POS fraud to your lax security, you may face steep fines, as I discussed in more detail in my earlier column, "Hackers up the ante for small business data security."
POS breaches are so widespread that earlier this month, the PCI Security Standards Council, an open, global forum for the development of payment card security standards, announced it was launching the "Passwords for Payments" initiative to help merchants avoid such breaches. Poor use of passwords contributes to hackers being able to penetrate your system.
So what can you do to protect your customers' information?
As the PCI council pointed out, criminals take advantage of easily guessed and weak passwords. One of the most common passwords is -- you guessed it -- "password." If you're using that password for your system or the default one that came with the system, change it -- today! Verizon's report suggests avoiding dictionary words, too, which are also known to be weak.
Don't forget to put smart password protocols in place with others who have access to your system, too. If a third-party vendor maintains your system for you, have a conversation about its policies for setting passwords. Do not allow the vendor to use the same password as it does for other clients. Verizon suggests restricting remote access to your POS system by such vendors, too.
There's a good reason for asking vendors to be cautious. In one incident in 2013, credentials were stolen from a POS vendor after being compromised by malware on that vendor's system. The vendor had been using the same password for all of the systems it serviced at different companies. Once hackers stole that password, they were able to get their hands on information on the customers of the vendor's client.
Verizon suggests installing anti-virus software on your POS system. Also avoid using your system to browse the Web, email, use social media or play games.
If you are in an industry that is especially vulnerable, I'd suggest setting up a meeting or phone call with your POS vendor to see if there are any other steps you should be taking. Some industries are hit harder than others by POS fraud. For instance, 75 percent of incidents in the accommodations industry are point-of-sale breaches, and 31 percent of those in retail fall into this category, according to the Verizon report. There may be special steps that your consultant recommends for people in your industry. Listen carefully. You can't be too careful about protecting customers' information.
Meet CreditCards.com's reader Q&A experts
Does a personal finance problem have you worried? Monday through Saturday, CreditCards.com's Q&A experts answer questions from readers. Ask a question, or click on any expert to see their previous answers.
- Is it safe for merchants to accept new digital payment forms like PayPal, Venmo, Zelle? – New payment options such as PayPal, Zelle and Venmo can be convenient for small businesses, but only with people you know and trust as they don't offer the same protections as credit cards, checks or ACH payments ...
- What are my rights regarding credit card surcharges? – Many businesses impose surcharges when customers use a credit card for under a certain amount. However, there are laws in place to protect you from being charged extra unfairly ...
- Can retailers offer digital-only receipts? – If you're a small business considering issuing electronic-only receipts, start by checking what local and state laws dictate. But you should also consider any possible privacy and liability concerns ...