SoftPOS, (Software Point of Sale), represents a huge shift in the way businesses handle secure payment transactions. Instead of relying on traditional hardware-based point-of-sale (POS) systems, SoftPOS leverages software applications installed on COTS (Commercial Off-The-Shelf) devices like smartphones or tablet devices), turning them into fully functional payment terminals. This is great for vendors as it means their merchants have a wide choice of device options. What’s more, it means that wherever merchants are operating, be it in the fuel, convenience & energy sector, large retail organisations, hospitality industries, or even ones operating unattended services that rely on card or digital wallet payments, it offers greater flexibility. This level of flexibility makes SoftPOS an attractive option for merchants of all sizes, as it means staff aren’t tied to a pay station and, in most cases, can walk around the shop floor or eatery, engaging and assisting customers. This is one of the factors contributing to SoftPOS uptake, with use of SoftPOS by merchants forecasted to increase by around 500% by 2027.
However, with such greatness comes great responsibility, especially from a security perspective, that needs to be effectively managed.
The biggest security risks of SoftPOS
Effective as SoftPOS is at providing a convenient and safe transaction method, there are a host of payment security challenges that come along with SoftPOS that need to be addressed for your merchants to feel confident about deploying SoftPOS into their stores.
Some of the security risks associated with SoftPOS are very much the same as those seen in traditional payment systems, however there are some unique challenges that SoftPOS faces:
- Data Breaches: Hackers can steal sensitive payment data, like credit card numbers, from SoftPOS systems, leading to financial losses and damage to a business's reputation. Data can be stored in a variety of locations including locally on the devices or on a cloud network that the device is linked to, increasing the number of vulnerabilities across the system. Strong encryption is a must for SoftPos devices.
- Malware Attacks: Malicious software can infect SoftPOS devices, allowing hackers to intercept payment information or gain control of devices. This is a particular concern for SoftPOS because these devices will have many different pieces of software operating on them.
- Insider Threats: Employees with access to SoftPOS systems may misuse their privileges, intentionally or accidentally, putting sensitive data at risk.
- Compliance Violations: Failing to comply with industry regulations, like PCI DSS, can result in penalties and increase the risk of data breaches.
- Social Engineering Scams: Hackers may use tactics like phishing to trick employees or customers into revealing sensitive information, compromising security.
- Non-Fixed Locations: Because of the high degree of flexibility SoftPOS devices offer, they are often used in pop-up shops and carried around locations by staff, as opposed to traditional devices which are at a fixed location. Whilst this flexibility is a bonus, it does introduce more vulnerabilities where data security could be compromised.
Security breaches can lead to the theft of sensitive payment data such as credit/debit card numbers and PINs, unauthorised access to systems, regulatory penalties, and reputational damage, which is why it’s crucial for businesses to ensure security risks have been effectively managed.
The good news is, industry stakeholders have developed thorough security standards and guidelines specifically tailored to SoftPOS technology that will help businesses do just that, and here at Aevi, we have developed innovative secure payment technologies that fully adhere to these guidelines.
Leading the charge in ensuring security is the Payment Card Industry Security Standards Council (PCI SSC), the regulatory body tasked with creating and upholding the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS lays out strict requirements aimed at protecting cardholder data and thwarting unauthorised entry into payment systems. Although initially crafted for conventional hardware-based POS terminals, the principles outlined in PCI DSS are just as relevant to SoftPOS solutions and should be applied by any merchant that uses SoftPOS technology. Also, it is expected that a new standard MPOC (Mobile Payments on COTS) will be published soon; Aevi will ensure we are fully compliant with this as it continues to develop.
Some key points of PCI DSS compliance for SoftPOS include:
1) Encryption and Tokenisation
SoftPOS applications must utilise robust encryption methods to safeguard sensitive data transmitted during payment transactions. Additionally, employing tokenisation techniques replaces cardholder data with unique identifiers, thereby lowering the risk of data theft in case of a breach.
2) Secure Authentication
Implementation of strong authentication measures, like MFA (multi-factor authentication) and biometric verification, is crucial to restrict access to the SoftPOS application solely to authorised users who can conduct transactions securely.
3) Secure Development Practices
Developers creating SoftPOS applications should adhere to secure coding standards and undergo regular security assessments to detect and address potential vulnerabilities. This entails incorporating secure communication protocols, frequently updating software components, and performing comprehensive penetration testing.
4) Device Security
Proper configuration and securing of devices used for SoftPOS applications are essential to prevent unauthorised access and tampering. This involves implementing device-level security controls, such as device encryption, remote device management, and secure device boot mechanisms.
In addition to PCI DSS compliance, other industry organisations, such as EMVCo and the Secure Technology Alliance, offer guidance and best practices for SoftPOS security solutions. EMVCo, the association responsible for the EMV® specifications for chip-based payment cards, provides recommendations for implementing secure contactless payment functionality in SoftPOS applications. Similarly, the Secure Technology Alliance offers resources and educational materials to help businesses navigate the complexities of SoftPOS security.
How can businesses safeguard against SoftPOS risks?
The first step to safeguarding your business against SoftPOS risks is knowledge and understanding what the security risks are and what measures need to be in place to mitigate them as recommended by the PCI DSS, which has been explained above.
Secondly, you would be wise to research secure payment services and choose a compliant SoftPOS secure payment platform that complies with industry security standards and regulations. Look for providers that prioritise security and offer robust encryption, in addition to offering best practices for protecting payment data.
At Aevi, we specialise in assisting businesses with secure payment SoftPOS integration using its existing infrastructure, and our platform and partnerships make it easy for businesses to transition to SoftPOS securely and safely.
