Card machines and payment security: the basics

The card industry’s rules, in plain English

Any business that takes card payments is expected to follow the card industry’s security standard, known as PCI DSS. For a small business using a modern card machine or payment provider, most of the heavy lifting is done for you, because the card details go straight from the machine to the provider.

Your provider may ask you to complete a short security questionnaire, often once a year. Answer it honestly. If you are not sure which questions apply to you, ask your provider: they deal with this all the time.

The golden rule: never keep card numbers

• Never write down a customer’s full card number or the three-digit security code, not even “just for a minute”.
• Never ask for card details by email, text, WhatsApp or social media, and never store them in a spreadsheet or booking system notes.
• If a customer sends you their card details in a message anyway, do not use them. Delete the message and send them a secure payment link instead.

Taking payments over the phone

• Use your provider’s secure options: a payment link sent by text or email, an online invoice, or a virtual terminal where you type the details straight in during the call.
• Type, do not write. Enter the details as the customer reads them out, then they are gone.
• If you record calls, pause the recording while card details are given. The security code must never be stored.
• Be careful with large orders from new customers who are not present, especially if the delivery address does not match or they are in a hurry. Payments made without the card present are the ones most often disputed.

Looking after the card machine

• Change the default PINs. Many machines have an admin or supervisor PIN, often needed for refunds. If it is still the one it came with, change it, and only share it with people who need it.
• Limit refunds. Refunds are where card machine fraud usually happens. Check them regularly against real sales.
• Keep its software up to date.Most machines update themselves when connected and charged. Follow your provider’s advice, such as leaving it on charge overnight.
• Check it for tampering now and then: unusual stickers, loose parts, extra wires, or a machine that looks slightly different. Keep it where you can see it, and keep spares locked away.
• Connect it to the right network. If it uses Wi-Fi, keep it on your business network, never the customer guest network. Our Wi-Fi guide explains how.

Scams aimed at businesses that take cards

• The fake engineer.Someone turns up or calls to “swap” or “update” your card machine. Your provider will tell you in advance through your account. If in doubt, call them on the number in their app or on their website before handing anything over.
• The overpayment.A customer pays too much “by mistake” and asks for the difference back by bank transfer. The card payment is later reversed and you lose both. Only ever refund to the same card.
• The refund to a different card. A request to refund onto another card, or in cash, for a card sale. Refunds should go back to the card that paid.
• Messages from your “card provider” asking you to log in or confirm details. Go to your account through the app or website you normally use, not the link. Our guide to scam texts and calls covers these.

If something looks wrong

Contact your card provider on the number in their app or on their website, and tell your bank. If you have lost money, report it to Report Fraud online or on 0300 123 2040, or to Police Scotland on 101.