An overlay, substituted unit, unfamiliar cable, or hidden reader can be added while a terminal still appears normal.[2][5] That is why a casual glance is not enough. Practical guidance: give every card-present terminal a trusted baseline, compare it before opening or at each shift change, and stop using it when the device no longer matches.[1][2][5]
Reporting cutoff: October 5, 2026 at 1:16:01 p.m. EDT (17:16:01 UTC). This is a merchant inspection and escalation checklist, not a PCI compliance assessment, forensic procedure, or permission to dismantle a terminal. Follow the current instructions from your acquiring bank, payment processor, terminal servicer, and qualified PCI adviser for your exact environment.
The costly failure: the register works, so nobody notices the hardware changed
The cited PCI guidance defines skimming as unauthorized capture and transfer of payment data.[2] It describes attacks involving compromised point-of-sale terminals, cables, overlays, hidden devices, substituted terminals, and people posing as service technicians.[2] The U.S. Secret Service says POS overlays may cover the full top of a terminal or only the keypad and card-reader area while capturing card data and keypad entries.[5]
The cited PCI DSS v4.0 SAQ P2PE requires covered deployed card-present point-of-interaction devices to be inventoried, periodically inspected for tampering or unauthorized substitution, and supported by personnel training and reporting procedures.[1] Practical guidance: your exact validation scope can differ, so confirm requirements with the organization that manages your PCI program rather than treating this article as an attestation.[1]
Affected—or not affected?
| Environment | Use this check? | Boundary |
|---|---|---|
| Retail counter, front desk, restaurant, clinic, salon, market, or mobile service using a dedicated card-present terminal | Yes | Inventory, visual comparison, staff training, and a documented stop-and-report path apply.[1] |
| Self-checkout, unattended kiosk, exterior reader, or terminal left unused for long periods | Yes—higher attention | The cited guidance identifies unattended or temporarily unattended terminals as attractive targets.[2][3] |
| Online-only checkout with no merchant card-present device | Not this hardware workflow | Practical guidance: use e-commerce payment-page and service-provider security controls instead; the cited SAQ P2PE states that it is not applicable to e-commerce channels.[1] |
| Ordinary computer keyboard used for manual card-number entry | Different scope | The cited requirement says its POI-device rule is not intended for manual PAN key-entry components such as computer keyboards.[1] |
| A suspicious terminal or possible skimmer has already been found | Stop inspecting | Take the terminal out of service, avoid handling the suspected device, and escalate through the processor and law-enforcement path.[3][5] |
Build the baseline before you need it
PCI DSS Requirement 9.5.1.1 in the cited SAQ calls for an up-to-date list containing each covered device’s make and model, location, and serial number or other unique identifier.[1] PCI’s skimming supplement recommends multiple front-and-back photos, label and security-mark details, connection counts, connector type and color, and the device’s normal location.[2]
Practical guidance: keep the baseline limited to device-identification and comparison details; exclude payment credentials, customer-sensitive data, and unsupported safety conclusions.[1][2][4]
Record once, update on change
- Make, exact model, serial number, and internal asset ID
- Store, counter, room, lane, or mobile kit assignment
- Front, back, sides, underside, seams, labels, and normal mounting
- Number, type, color, and route of expected cables
- Processor or servicer name and independently verified contact path
Keep out of the checklist
- Full payment card numbers or PINs
- Customer receipts containing sensitive data
- Terminal administrator passwords or service codes
- Publicly shared photos showing sensitive identifiers
- Guesses about whether a device is safe
The opening or shift-change check
Practical guidance: use a short written checklist and the trusted baseline. The goal is to recognize a mismatch and escalate—not to prove that hidden hardware is absent.[1][2]
Compare every visible surface with the reference photos
Practical guidance: look for a changed shape, color, keypad height, card-slot profile, display bezel, seam, screw, label, seal, scratch pattern, added material, hole, or cover.[2][4] PCI and Visa both recommend recording normal terminal characteristics so later differences are easier to recognize.[2][4]
Check the mounting and surroundings without dismantling anything
Practical guidance: confirm the terminal remains in its approved stand or tether and that nearby displays, ceiling areas, fixtures, and countertop objects match the known setup. Do not drill, open, remove seals, pry covers, unplug evidence, or follow an improvised online teardown.[2][4]
Log the check and name the next owner
Practical guidance: record the terminal ID, date and time, checker, result, and any escalation reference. If the baseline is missing or a difference cannot be explained through the trusted processor or servicer path, mark the terminal unavailable until an authorized owner resolves it.[1] PCI’s cited requirements pair inspection with training and reporting, not silent judgment by one employee.[1]
A visual check cannot prove a terminal is clean
PCI’s supplement notes that some hidden skimming equipment may not be visible to staff or customers, and the Secret Service says some ATM skimmers can be impossible to detect from the exterior.[2][5] Practical guidance: a completed checklist means the visible device matched the approved baseline at that moment; it is not a forensic clearance or guarantee.[2][5]
Practical guidance: if fraud reports, processor alerts, terminal behavior, surveillance gaps, unauthorized access, or inventory mismatches raise concern, use the processor’s incident procedure even when the exterior looks normal.[2][5]
Control repair visits and terminal swaps
Practical guidance: verify every service visit through the processor or servicer contact already in your records, keep an authorized employee present, and do not install, replace, or return a payment device without verification.[1][4]
- Practical guidance: do not trust a uniform, badge, caller ID, work order, or phone number supplied by the visitor as sole proof.[1]
- Practical guidance: verify the appointment through the processor or servicer contact already in your records—not a number on an unexpected message.[1][4]
- Practical guidance: match the person, company, time window, terminal ID, and approved work scope before access.[1]
- Practical guidance: keep an authorized employee present while work occurs, subject to the provider’s procedure.[4]
- Practical guidance: record removed and replacement serial numbers; photograph the approved replacement baseline before it enters service.[1][2]
- Practical guidance: do not install, replace, or return a payment device without verification. The cited PCI training requirement explicitly includes technician identity checks and controls over device installation, replacement, and return.[1]
If something does not match
- Practical guidance: stop transactions on that terminal. Do not run a test card.[5]
- Practical guidance: do not handle, detach, open, power-cycle, or unplug the suspected device unless emergency safety requires it or law enforcement gives that direction.[3][5] Visa warns that handling a discovered skimmer can damage evidence.[3] The Secret Service directs businesses to contact law enforcement so officers can retrieve the device and handle it as evidence.[5]
- Practical guidance: prevent further use safely. Follow the approved incident plan; do not create a confrontation with a suspected person.[3][5]
- Practical guidance: notify the acquiring bank or payment processor and the designated business incident owner. Use independently verified contact details.[3][4]
- Contact local law enforcement. The Secret Service advises law enforcement retrieval and evidence handling for a suspected skimmer.[5]
- Practical guidance: preserve evidence. Protect relevant surveillance video, access records, inspection logs, processor alerts, staff observations, and the earliest known good and first known suspicious times.[3]
- Practical guidance: let the processor and incident team define customer and card-brand notifications. Do not improvise a public accusation or expose customer data.[3][5]
Two realistic examples
Harmless mismatch
A salon’s opening check finds a different power-cable color. The manager stops using the terminal and calls the processor through the saved support number. The processor confirms an authorized cable replacement from the previous day, and the manager updates the maintenance log and baseline photo before returning the terminal to service. The pause was inconvenient; guessing would have been worse.
Costly wrong turn
A shop sees a raised keypad edge and an unknown sticker. An employee pulls off the cover, unplugs the terminal, throws away the sticker, and runs a test purchase. Practical guidance: that risks exposing another card and disturbing potential evidence; stop use, avoid handling, preserve records, and escalate.[3][5]
Frequently asked questions
How often should a business inspect terminals?
The cited PCI DSS requirement says periodically; it does not set one universal interval in the quoted requirement.[1] PCI’s 2014 supplement says a routine could be daily or at the beginning of each shift, while Visa’s 2016 alert recommended at least twice daily and random times for the incidents it addressed.[2][3] Practical guidance: set and document an interval based on the processor’s current direction, device exposure, staffing, business hours, and risk.[1][2][3]
Can staff tug on the keypad or remove a loose cover?
The Secret Service gives consumers a limited exterior looseness check, while Visa says businesses should not handle a discovered skimming device because evidence may be damaged.[3][5] Practical guidance: employees should not turn a routine check into an improvised teardown; use only the current processor-approved inspection procedure for the exact terminal and stop when anything is suspicious.[3][5]
Does tap-to-pay make terminal inspection unnecessary?
No. The Secret Service recommends contactless or chip transactions as safer choices for consumers than cards lacking EMV chips, but it also describes POS overlays that can capture data and keypad entries.[5] Practical guidance: merchants should still protect, inventory, inspect, and control access to covered devices.[1]
What if the serial-number label is hard to reach?
Practical guidance: record the identifier through the approved setup or maintenance process and keep reference photos that do not expose sensitive data publicly. Do not unmount, open, or break a seal during a routine shift check. Ask the processor how the model should be identified and inspected.[1][2]
Should security cameras point at the terminal?
PCI and Visa support surveillance around payment areas, but both caution against recording customers’ PIN entry.[2][4] Practical guidance: position cameras and retain footage according to current law, processor requirements, privacy policy, and professional advice.[2][4]
Does passing the checklist prove PCI compliance?
No. It documents one operational control at one point in time. Practical guidance: PCI scope, required controls, validation method, service-provider responsibilities, and evidence depend on the merchant environment and the entity receiving the assessment.[1]
Related IT Guys guides
- Your security cameras may show live video but record nothing—verify that footage actually exists before an incident.
- Forgotten remote-support software can become a back door—audit remote access separately from physical terminal checks.
- Paid the wrong bank account after a vendor email?—use the first-30-minutes fraud response for payment-redirection incidents.
Your next action
Practical guidance: before the next shift, choose one terminal and create its trusted record: exact location, make, model, serial number, front/back/side photos, expected labels and seals, cable count and colors, approved servicer, and the stop-and-report contacts. Then have a second employee use that record to perform the check. If the baseline cannot guide a clear decision, fix the checklist before scaling it to every device.[1][2]
Need help turning payment-terminal checks, camera verification, and vendor-access controls into a small-business runbook? Book an appointment with The IT Guys.