The flight of points of sale terminals, a frequent scam, say merchants

Merchants from the Toronto region lose thousands of dollars due to a frequent scam: criminals fly their point of sale terminals, then use the reimbursement function to empty the accounts of the referred merchants.

I just lost $ 2000, for suresaid Shiro Maruo, Nana owner on Saturday Floristin an interview. He says he was the target of two fraudsters.

In 2023 in Toronto, nearly 300 of these devices were stolen, said last year Shannon Dawsonof the Toronto Police.

Several traders contacted by Radio-Canada tell similar stories. The criminals enter their business. They claim to want to buy something. They distract the owner or the employee. Then they fly the payment terminal.

Each company loses about $ 2,600 each time this scenario occursexplained Vincent Kang, director of franchise for restaurants Halibut House Fish and ChipsSATURDAY.

These scams affect all types of businesses. Radio-Canada spoke to a florist, restaurateurs and a garage of tires who say they are victims.

However, losses do not stop at money flights: companies must also replace their stolen terminal at a cost of $ 600, says Kang. What is more, terminal companies reject responsibility for merchants: according to them, they neglect to protect themselves adequately from theft.

The scam in detail

On June 21, around 3 p.m., a man entered Nana Florist on the avenue Danforth in Toronto. He wants to buy a plant. When he tries the transaction, his debit card is refused. This is what the owner Shiro Maruo says.

He asked me at what time we close. I said around 4 p.m. He said he was going to come back.

10 minutes later, the man returns with an accomplice. They claim to want to buy 18 roses. The owner explains the prices.

My attention was elsewhere. The other man – we see him on the video – exchanged my point of sale machine with one he had broughtExit M. Maruo.

He shared the video from his security camera with Radio-Canada.

The replacement terminal is very similar to the original. The florist does not notice anything. The two men leave without buying anything.

With the video, I can clearly see the little guy do like thatsaid Mr. Maruo, mimicking a gesture of victory. It means mission accomplished. It was a signal to the other guy.

Around 3:30 p.m., Mr. Maruo received an email from Cloverhis company of payment terminals. It is advised that the manager’s password has been changed.

I looked at the terminal, the point of sale terminal, and it looked same, but it was not mineExplique M. Maruo.

Once in possession of Mr. Maruo’s terminal, criminals use the reimbursement function. They get $ 1,000 at 3:10 p.m., according to Mr. Maruo, then $ 1,000 more at 3:11 p.m.

[L’opération enregistrée] was a refund on the debit card of this man.

A chain of restaurants targeted four times

For his part, Vincent Kang experienced a series of attacks against his restaurant chain. Halibut House Fish and Chips Account 43 establishments in Ontario.

One of our locations in Oshawa – at 288 rue Bloor – contacted me one evening. A customer had come to eat and would pay his meal. The server had left the terminal with the customer while he was going to do another task. When he returned, the aircraft had been stolensays Mr. Kang.

As the device is already connected using the server password, the thief uses the reimbursement function to appropriate $ 2000, according to Kang.

He immediately sends a warning email to all his franchisees. Too late.

I immediately received an answer from our location in Thornhill – at 11 Promenade Sarah – which says that there too, a flight had occurred and that it was even a scenario.

Within 48 hours followed, two other locations were affected, according to Kang.

The losses do not stop at fraudulent reimbursements, according to Mr. Kang. Merchants must also replace their stolen terminal with the payment company with whom they do business.

So each company loses about $ 2,600 each time this scenario occurs.

Mr. Kang would like to have more help from payment companies. According to him, Even if I called 5 minutes after the flight, they would say: “The transaction has already taken place, this money has already been stolen and there is nothing we can do”says Mr. Kang.

Such a touched garage

Charmaine Carvalhoowner of the garage Total Tire of Pickeringwas also the victim of this scam, she said. His story resembles that of other traders.

Two gentlemen entered. We sell detail products. They looked at our detail products. One of them said, “Oh, do you have old tires in the back?”said Ms. Carvalho Saturday during an interview with CBC.

His manager Dan brings them to the back of the store.

Both followed Dan […] But I suppose that one left halfway. He mainly stole the point of sale machine and fled. Meanwhile, the man who remained with the manager continues to occupy him, according to Ms. Carvalho.

It mainly stole approximately $ 2,200.

Unlike other victims, Ms. Carvalho claims to have been lucky: Clover agreed to reimburse her, she said.

Beyond financial losses, these flights traumatize employees and owners, according to Carvalho.

Everyone is afraid, at the store. The machine is hidden. Passwords have all been changed. We check each client 100 timesshe said. We had to give a few days off for mental stress to our employees. We are closing on Saturdays, which we didn’t do before, just to break everyone.

Companies reject responsibility

According to the companies of points of sale terminals, traders must protect themselves better.

Business owners have total control over reimbursement permissions – allowing organizations to deactivate reimbursements, set limits and assign rights to employees to staff.

Clover Also said that she is working to educate merchants about security parameters.

Moneris, another company of terminals, has a similar speech.

When merchants first configure their devices, they are invited to define administrative passwords. It is recommended that they also configure user profiles and permissions to, for example, reimbursementswrote Darrarr Leroux, director of external communications at Moneris, in an email at Radio-Canada.

The company insists on the responsibility of traders.

It is important to note that it is also the responsibility of companies to observe the transaction and to verify it. The devices should not be left unattended and should be treated with the same security as cashcan we read in the email.

The opposite of security is convenience

Claudiu Popa, cybersecurity expert and CEO of Data risk Canada, explains why these scams work so well.

The opposite of security is convenience. So each manufacturer who creates all types of tools, transaction tools, payment tools, digital keyboards, etc., books in a condition that is as easy to use as possible as possible as possiblesaid Mr. Popa on Saturday during an interview with CBC.

The terminals arrive with very simple default passwords, according to Mr. Popa, for example 0000 or 1234.

These types of fraud can take as little as 20 seconds to executespecifies Mr. Popa.

He explains that criminals use two main methods.

The first is to physically exchange terminals, as what happened to the florist, Mr. Maruo.

In many cases, when it is very busy, it is super easy for someone to enter the store and replace this point of sale terminal with an identical. They have spotted the place in the past. They know exactly which model they useI explained M. stern.

The second method is to use the reimbursement function directly on the trade terminal.

To access the refund menu, you must enter a password. Once you enter it, [un menu permet de] Slide a card and “reimburse” an amount.

Now, Mr. Popa believes that terminal companies have more responsibility than they say.

I personally think that points of sale companies must be held at a much higher standard. When they deliver a unit, this unit should be secure. They should have changed their default passwords and they should have deactivated their default reimbursement functionalityDit M. Popa.

Police advice

Toronto police confirm that they are aware of these events. Laura Brabant, spokesperson for the Toronto Police Service (TPS), has issued some advice to traders: keeping the terminals out of the reach of customers when the store is open, hiding them, locking them when the store is closed, and changing the default code.

For his part, Mr. Maruo says he is discouraged from his interaction with the TPS. He claims to have had to wait six hours on the phone to talk to a police officer on the night of the flight.

Finally, someone answered. I explained what had happened. He asked me if I would like to open a file. I said of course, I would like to open a file. I want the police to catch these guys and I also want to recover the moneysaid Mr. Maruo.

The police ‘response left him speechless.

His answer was: “Do you think you can recover the money?” Mr. Mauro is still so surprised by this comment. I have the impression that it happens often and that they are too busy, that they do not want to be disturbed.

According to information from Rozenn Nicolle and Andréane Williams