PIN Pad Skimmers: How Retailers Should Inspect Card Terminals
A practical PIN pad skimmer inspection routine for retail staff: what to check each shift, how PCI device rules apply, and what to do if you find one.
Photo: Pixabay
On this page 6 sections
Key takeaways
- Inspect each terminal at shift start, and compare the serial on its screen as well as the sticker, because stickers can be copied.
- A PCI-approved terminal's tamper protection won't react to an external overlay or a full device swap. Only a person looking will catch those.
- If you find tampering, leave the device untouched and call your processor's risk team before you contact any customers.
- Unscheduled "technicians" get verified through the phone number on your contract, never one they hand you.
Check every card terminal in your store at the start of each shift. Confirm the device is the one on your list, look for anything added to the card slot or keypad, and make sure the seals, cables and mounts haven't been disturbed. A PIN pad skimmer inspection like this takes a couple of minutes per device. It helps staff spot overlays and swapped terminals early, before more customers' cards are exposed. It also supports the device-protection requirements in PCI DSS. Ask your processor exactly what they expect from your store.
The routine is below, with the reasons behind each step and what to do when a check turns something up.
How Card Terminal Tampering Happens in Retail Stores
Criminals go after retail terminals in four main ways.
Overlays are thin plastic shells that fit over the keypad or around the card slot. A keypad overlay records each PIN typed through it. A slot overlay reads the magnetic stripe as the card passes.
Shimmers are paper-thin circuit boards slid inside the chip slot. They sit between the card and the terminal's reader and are almost invisible from outside.
Hidden cameras are pinhole lenses tucked into a nearby fixture, such as a shelf edge, a price sign or a counter display. They're aimed at the keypad to capture PINs.
Device substitution is the boldest method. Someone replaces your real terminal with a tampered look-alike. The swap can take seconds while a cashier is pulled away, or it can arrive through a fake technician visit, which has its own section below.
Retail counters give thieves openings. Customer-facing PIN pads often sit at the end of the counter, near the door. Seasonal staff turn over during the holiday rush, when lines are long and nobody is watching the far register. Self-checkout lanes can go minutes without an employee nearby. Regular inspection is the one defense that works in all of these settings.
Contactless payments shrink part of the exposure. A tapped card or phone never enters the chip slot or touches a stripe reader, so a slot overlay or shimmer gets nothing from that sale. A keypad overlay or camera can still record a PIN if the customer enters one. Encourage tap, but keep inspecting. Our guide to Apple Pay and mobile wallet security explains why tap transactions are harder to steal.
PCI Device Inspection Requirements for Retail Stores
PCI DSS is the data security standard published by the PCI Security Standards Council, a body founded by the major card networks. It is not federal law. You're bound to it through your merchant agreement with your processor and acquiring bank, and your processor decides how you validate compliance and what happens if you don't.
The standard has a section on protecting card-reading devices at the point of sale from tampering and substitution. Requirement numbers and wording change between versions, so read the current text on the Council's website or ask your processor which requirements apply to your validation. In practice, a retail store should be able to show three things:
- A current list of every payment device, with make, model, location and serial number
- A record of periodic inspections for tampering (parts added or altered) and substitution (the whole device swapped)
- Staff who know how to recognize tampering, report it, and verify anyone who claims to service a terminal
Our guide to PCI compliance for retail stores covers the rest of your obligations, including phone orders and back-office systems.
A Certified Terminal Still Needs Inspecting
Many owners assume a PCI-approved terminal handles this for them. It doesn't. Approval covers how the device is built. Approved PIN pads are designed to be tamper-responsive, which typically means they erase their encryption keys or shut down if someone opens the case. An overlay glued to the outside never opens the case. A swapped terminal isn't your device at all. Neither one sets off the built-in protection, so a person still has to look.
Setting Your Inspection Frequency
The schedule below is our recommendation, not a network rule. Write down the schedule you choose and why, and ask your processor how they expect you to document and justify it.
| Device location | Suggested inspection |
|---|---|
| Staffed counter, in constant view | Start of each shift |
| Self-checkout or unattended counter | Start of each shift, plus a midday check |
| Handheld or mobile terminals | When handed out and when returned |
| Spare terminals in storage | Before each one goes back into service |
A Daily PIN Pad Skimmer Inspection Checklist
Prepare two things first. The first is your device list. The second is a set of reference photos of each terminal, taken when it was new or freshly verified: front, back, sides, and straight into the card slot. Laminate the photos or keep them on a shared tablet. Staff can't spot a difference without something to compare against.
Then, at each terminal:
- Match the sticker serial number. Turn the device over and compare the serial label to your list. This is one of the most important checks, because a good fake can look identical from the front.
- Match the electronic serial number. Many terminals display their serial number on screen or in a settings menu. Compare it with both the sticker and your list. A thief can copy or relabel a sticker, but a mismatch between the screen and the label is a strong warning sign. Ask your processor where the setting is on your model if you can't find it.
- Compare the device to the photos. Look for differences in color, logo placement, label fonts, screw heads and the gap around the card slot.
- Grip and tug the card slot and keypad. Genuine parts are molded into the housing and don't move. An overlay often shifts, flexes or feels raised.
- Press several keys. Keys that feel spongy or stiff, or that sit higher than usual, can point to an overlay.
- Shine a flashlight into the chip slot. Look for anything that doesn't match your reference photo of the slot interior, such as a visible edge, a shiny strip, or a slot that looks shallower than it should.
- Check seals and cables. If you use tamper-evident stickers over seams or screws, confirm each one is intact. Trace every cable to its proper port and look for extra wires, adapters or an unexplained USB device.
- Scan the surroundings. Check anything with a line of sight to the keypad for small holes or objects that weren't there before.
- Log it. Record the date, time, device, result and the employee's initials.
The log matters more than it looks. If you ever find tampering, the last clean entry tells your processor and investigators which window of transactions may be affected. Here is an illustrative format:
| Date | Time | Device / serial | Location | Result | Initials |
|---|---|---|---|---|---|
| 11/06 | 8:52 a.m. | PIN pad, SN ending 4471 | Register 2 | OK | JR |
| 11/06 | 8:55 a.m. | PIN pad, SN ending 4483 | Self-checkout A | Seal torn, reported | JR |
Securing Terminals at Unattended Counters
Self-checkout lanes, kiosks and counters that sit unwatched need physical protection on top of inspection.
Mount fixed terminals in locking stands or tether them with security cables so nobody can lift one and swap it in seconds. Put tamper-evident labels over seams and screws, and write the device's serial number on each label so a replacement sticker stands out. Aim security cameras at the terminal and anyone who handles it, but not at the keypad itself. A camera recording PINs is a liability, even if it's yours.
At closing, lock up handheld and mobile terminals instead of leaving them on the counter. Keep spares in a locked drawer, with their serial numbers on your list. Some smart terminals and integrated POS systems report device status to an online dashboard, so a terminal that drops offline unexpectedly can prompt someone to check it. If your current stands, cables or older devices make inspection awkward, newer PIN pads with simpler housings and fewer seams are easier to check.
What to Do If You Find a Skimmer
Stay calm and preserve the evidence. Whoever planted the device may come back to collect it, which is useful to police.
- Take the terminal out of service and switch to a backup device.
- Don't remove the overlay, open the device or wipe it down. Fingerprints and the hardware itself are evidence.
- Photograph the terminal and the area around it from several angles.
- Call your processor right away and ask for the security or risk team. They'll tell you what to do next and may arrange a replacement.
- Report it to local law enforcement and keep the report number.
- Save camera footage from the period since the last clean inspection, along with the terminal's transaction history for the same window.
Don't contact customers yourself before you've spoken with your processor. Card issuers typically notify affected cardholders through the networks, but state data breach laws may also place obligations on your business, and those laws differ from state to state. Talk to a qualified attorney about what applies to you. This article is general information, not legal advice.
Tampering at the terminal is a separate problem from a customer handing over a stolen card. For that side of in-store fraud, see our guide on spotting stolen cards at the register.
Training Staff to Spot Fake Technicians
Social engineering is a common route to device substitution. Someone in a polo shirt with a clipboard says the processor sent them to "update" or "replace" the terminal, and a busy cashier waves them behind the counter.
Write a short policy and have every employee read it, including seasonal hires:
- No one services, replaces or removes a payment device unless a manager has already scheduled the visit.
- Unscheduled visitors are verified by calling your processor at the number on your statement or contract, never a number the visitor provides.
- Staff ask for identification and log the visitor's name, company, arrival time and the devices touched.
- A visitor is never left alone with a terminal, even for a minute.
- After any service visit, the full inspection checklist is run on every device that was touched.
Phone scams follow the same pattern. A caller claiming to be "the help desk" may ask a cashier to run test transactions, change settings or read out terminal details. Staff should end the call and have a manager call back through the official number.
Train during onboarding and again before the holiday season, and run a quick drill now and then. For example, a manager can stick a harmless strip of tape along a slot edge or swap two cables, then see whether the morning check catches it.
This week, build your device list and take reference photos before the next shift opens, then post the checklist next to each register. If your terminals are old, hard to inspect or not on any list, request a free quote. A MannyPay specialist can review your retail payment setup and hardware options with you.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
