About a year ago one of the founders of Twitter and some other talented business persons came up with a mobile payment method called square. Square is a very tiny card reader that attaches to the audio port on a smart phone. It’s truly a clever little device that utilizes an existing port that just about every phone has. Merchant’s can sign up with Square without any fee and just about instantly process. Because of the ease of setup, there’s been some angry customers with money held, but something like this should be expected as the services operates on a similar model to Paypal. Square got some quick funding, and went off to the races faster than any payment related service in history. However, there’s a problem…

Unfortunately, Square also introduced one of the most efficient and low cost methods of creating an advanced credit card skimmer. When you sign up with Square’s processing service, you get the square for FREE. That’s right, for free you can turn your iPhone into a credit card skimming device. Thieves don’t even have to pay the $50 or so for a skimmer anymore, they get one for free. Not only is Square efficient and free, but they’ve already distributed hundreds of thousands of these little skimming nightmares all over the US.

A criminal signs up with Square, obtains the dongle for free and creates a fake Square app on his smartphone. Insert the dongle into the audio jack of a smartphone or iPad, and you’ve got a mobile skimming device that fits in your pocket and that can be used to illegally collect personal and financial data from the magnetic stripe of a payment card. It’s shockingly simple.

There are 2 major problem with the Square hardware.

First, the square device does not encrypt data being transmitted between the reader and the phone. This could easily leave the service open to a targeted attack where other software could read the card information when it is being transmitted between the reader and the phone. This sort of issue may never be a major problem as it would take very specific software or a compromised phone for this flaw to be taken advantage of. However, it still remains a security possibility, one that cannot be overcome without updating the hardware completely.

Second, since the hardware has no encryption or secure link between it and the phone/square service, a programmer could easily write a program that would simply record the card information onto a database or file on the phone. This is the main problem that Verifone and many others are up in arms about. With the large memory cards that are commonly found in phones, a thief could theoretically store millions of card numbers on their phone. Additionally, since just about everyone has a cell phone, it is considerably less conspicuous for a thief to skim cards with a phone than with the dedicated skimmers which look something between a pager or a magnetic card reader you would see attached to a computer.

This morning, VeriFone launched an entire website dedicated towards bringing down square. While VeriFone is a direct and probably the largest competitor of Square with their PayWare Mobile App, they have quickly illustrated not only that the square can be used for skimming, but that there is software that can already be used with the square hardware.

The problem now is that there are tons of these square credit cards readers all over the place, so the damage has already been done. At this point there’s literally nothing that can be done to prevent skimming using square devices. There’s even applications for blackberry and android that already work with the square hardware even though it was designed for the iPhone and iPad. I think that this sort of hardware is a perfect example of what happens when a company pushes software or hardware without putting enough in the research in how to make it secure. There’s more than 1 way to steal a credit card number…

With the amount of focus on PCI and data security of the last 10 years this is a blatant disregard for the most basic best practices, even those established 10 years ago. Twitter may be a whimsical concept, but there’s really nothing amusing about completely botching credit card data security at the expense of consumers and the businesses whom accept those stolen cards…

Update 03-10-2011

So, Jack Dorsey issued a rebuttal to VeriFone‘s website and statements about the Square.

Second, as Dorsey points out, credit card fraud is not new. Every single time you hand over your credit card to someone (whether it is a merchant using Square, or any one of the dozens of other credit card input methods) you are trusting them not to steal it. Criminals steal credit card numbers all the time, both online and offline. But it happens, and when it does, consumers are not liable for fraudulent charges, the credit card companies are.

What’s not fair or accurate is Jack Dorsey’s fundamental lack of understanding of how the credit card industry works! Any merchant knows that if they accept a credit card that was stolen, they are liable for the fraudulent charges. There’s no magical credit card company that’s going to float in and take responsibility for it. The merchant loses when it comes to credit card fraud, plain and simple.

This disregard to merchants all while Square is trying to sell them a processing service is simply insulting. I’m a merchant as well, and this is just disrespectful.

After reading this, I am completely convinced that Jack Dorsey and Square have no business providing a payment service of any type to anyone. Stick to tweeting…

Verifone just acquired Hypercom corporation. This effectively removes all legitimate competition from the US credit card terminal market. Verifone’s own products have suffered a decline in reliability and quality starting 5 or 6 years ago, so naturally Verifone began purchasing competitors. They started with wireless leader Lipman, and then acquired Way Systems, and now have taken down the last barrier, Hypercom. Verifone stated that this acquisition was to expand their presence in the European market, but make no mistake it removed their last competition from the US market completely.

I don’t want to forget Ingenico whom is one of the worlds largest terminal manufacturers, however they are a mere drop in the bucket in the US and sell almost exclusively to large chains and direct placement deals that normal mom and pop merchants will never see.

I’m personally appalled that the government allowed this transaction to take place. On the bright side, if Verifone cannot produce a higher quality product, there’s several smaller manufacturers that are already gaining serious ground, most notably Dejavoo, ready to replace Hypercom. This will provide the perfect avenue for Dejavoo and others to become much larger terminal brands (until Verifone purchases them of course). Dejavoo’s product is far superior to Verifone or Hypercom and is cheaper than either.

I’m seriously holding back words on writing this. The impact of this on the credit card terminal industry would be comparable to Walmart purchasing Target or Microsoft purchasing Apple. This sort of acquisition is the reason that anti-trust laws exist. It’s unfortunate that the government’s priorities are so far removed from the B2B industries of the country.

Why use a POS system?

POS systems can greatly increase a business’s operational efficiency. They allow fast checkout at the counter, and can be used to manage inventory, priced, sales, and everything else a retail business would need with respect to the checkout process. Many of the more advanced models can integrate with a database that also controls an ecommerce website for unified inventory and ordering control. They can be self contained units, with an attached credit card reader and printer, which can make for a much cleaner and more organized counter-top. For restaurants, a POS system holds the entire menu, and often uses a fast touch-screen interface. This can reduce wait staff / kitchen errors, add and calculate gratuity, and make the entire payment process significantly smoother. POS systems can save lost sales and handle sales better than the fastest cash register operator. POS systems can truly alter the speed and efficiency that a business operates.

Why not use a POS system?

The point of this article is not to discredit POS systems, as they are absolutely essential for many retail businesses. It is rather to get business owners to look at every aspect of the system before making their decision. This will hopefully relieve some of the upgrade and support shock that is commonly experienced with POS systems down the road.

Cost, cost, cost…

The increased convenience that comes with a POS system often comes at a very high price. Not to say this price is never offset by increased sales and customer satisfaction, but there are real costs in purchasing and owning a POS system. First, there’s the actual monetary price to purchase or lease a POS system which is can be very high, up to $5000 per checkout lane in some cases. There’s often additional fees for each transaction you process because the POS system has to use special connections with processing networks. There’s the cost of programming and maintaining the POS system. The initial setup is usually done by a supporting company that comes on-site to install the system. However, just like a computer network, there must be someone on-staff or on-call or on-contract that can manage the POS system. Managing a POS would include making changes to prices, adding inventory, training, etc., but also includes managing the system in case of errors, power failure, hardware failures, and every other failure scenario a computer, credit card terminal and computer network might run into. If the business owner or manager is not technically-savvy, which is commonplace, it means hiring a person or company to manage the system.

Whether you are going to do it yourself, hire a dedicated employee, or hire a support company to manage and maintain your system, make sure you understand the potential costs and the potential pitfalls of every method.

Upgrades

The upgrades that POS systems require are not always free or even cheap. When you purchase a POS system, it usually comes with a support contract. Depending on the support contract, it may include updates for the life of the POS system, or it may not include major updates, or may not include updates past a certain time period, or may not include any updates at all. It may not include adding new peripherals to the system. You need to add a second bar code scanner? $500 please!

When security regulations change, or when a bug or flaw in the system is discovered and the whole application needs an overhaul, you may end up shelling out a few thousand dollars per lane for upgrades that you have no choice in installing! If you decide to change credit card processors, I’ve seen multi-thousand dollar fees just to update the system with the new credit card processors information.

The point is, POS systems have costs that go well beyond the initial purchase of the system. Make sure you understand all setup costs, upgrade terms and costs, adding or changing peripherals, adding or changing credit card processors, and any other recurring or unanticipated fees that might be required in the future.

Security

PCI-DSS is a constantly evolving guideline for security, and POS systems are often at the sharp end of the regulations. When business owners purchase a POS system, they often assume that the provider is responsible for the security of the system. What we have found in the past 2 years is that this is often not the case, or at least not entirely the case. Even if you have no idea how to manage a POS system, let alone make sure it is secure, you may be responsible and fully liable in the event that someone steals data from your company. Security should be the #1 factor in your decision to purchase a POS system, even before making sure it has all of the features that you need. Neither consumers nor card issuers give a pass for ignorance. Do your homework and make sure that the system is secure now (and PCI compliant) and will be secure, or at least able to upgrade as security policies change, over the next 10 years. Also make sure you understand whom is responsible for the security of the system, most likely it will be you.

Proprietary

Some of the POS systems out there have requirements to process with them or with a certain company. While this can work for some businesses, I am always against merchants being tied down to any single provider. If you’re using a proprietary POS system, and your credit card processor is terrible or is ripping you off, it doesn’t matter. You’ve already made the huge investment in money, time, and training, and you’re not going anywhere. The POS provider and the credit card processor know this as well. If you use a product or service that has effectively eliminated competition due to contractual obligations and / or proprietary equipment, expect them to act that way!

Overkill

The final reason not to use a POS system, is that is it simply overkill for many businesses. Because the price for a POS system requires a great deal of thought and money for a business owner, it’s not common that I see businesses with a POS system that don’t need one, but it does happen. For very small retail and restaurants, a cash register and credit card terminal are often completely sufficient, and can save the business owner thousands of dollars and hours of headaches. Only you can decide this, but don’t chose a multi-thousand dollar POS system just because you think you need it. Don’t chose a credit card terminal just because you think you’ll never need a POS.

These are things that should be well understood before deciding on any method for checkout and payment processing. POS systems are one of the best ways to help a retail business, but if not understood or poorly planned, they can be the biggest money drain you ever experience.

Finally, always have a backup!

No matter what method you choose for your business, make sure you have a backup method of checking out customers and accepting payments. This could mean a calculator and a low cost credit card terminal for some, or just a manual imprinter for others. An outage of your POS system shouldn’t compromise your business.

So far we’ve added most terminals from major manufacturers over the past 30 years, and more will be added as we figure out when they were released. It’s quite difficult to get information on the release of many terminals as most manufacturers don’t publish historical information such as this. This is especially difficult for many of the pre-2000 terminals.

Related posts:
Brief history of credit card terminals in the US

A few years ago a new terminal company named Dejavoo was established. Dejavoo was founded by the original founder of Lipman USA, and seems to be founded on the same principles that Lipman was:  rock-solid products that are easy to use and very reliable. In my opinion Lipman’s Nurit 2085 is the most reliable and best land-line terminal to date. It isn’t very small, and it doesn’t look particularly classy, but it works well, it’s cheap, and it’s easy to use. Having watched the reliability of credit card terminals diminish over the past 10 years, I would love to see a highly-reliable brand emerge. Since the terminal market is monopolized by a few behemoths, it’s equally good to see a new competitor with a strong history of success in this specific industry.

Dejavoo currently offers several terminals which should meet the requirements of most merchants, whether retail or mobile. One of the coolest  things about the Dejavoo terminals, is that they all (except the C5 and M3) support a USB WiFi adapter, allowing a merchant with a secure WiFi network to eliminate an extra cord on their counter-top.

All Dejavoo terminals have quick thermal printers, and have internal PINpads. Dejavoo terminals meet the newer PCI-PED requirements for PINpads. Lastly, all Dejavoo terminals are at the lower end, if not the lowest, of cost for comparable terminals from other manufacturers.

Wired Dejavoo Terminals

Dejavoo C5 – The C5 is the entry level terminal from Dejavoo. It is dial only, and does not support USB components like the X series. It is the lowest cost terminal from Dejavoo. It is PCI certified and would be a comparable replacement for Nurit 2085, Hypercom T7 Plus, and similar products. The C5 looks to be the most durable of the Dejavoo terminals, and is slightly larger than the X or M lines. Most merchants will probably want the additional features of the X line, as the entry X5 terminal is a significant improvement to the C5 without a significant price increase.

Dejavoo X5 – The X5 is the first terminal in the X-line. It uses a custom Linux operating system, dual processors, and supports USB peripherals including the USB WiFi adapter. It features a compact, well styled design, and supports a multitude of features all for a low price. It is a dial-only terminal, but has more memory than current Verifone or Hypercom terminals. It is PCI compliant, and features a smart card reader and internal PINpad.

Dejavoo X8 – The X8 is almost the same as the X5 except that it supports processing over an 10/100 IP/Ethernet connection in addition to a dial-connection, and has an additional USB port. It is currently the lowest cost Ethernet terminal that we know of, just edging out the Hypercom T4220.

Wireless Dejavoo Terminals

Dejavoo M3, M5 and M8

The Dejavoo M series, are PCI certified, GPRS, wireless terminals. They are all based on the same M3 platform. The M5 has a base which includes a charging station. The M8 includes a base with an Ethernet port. The M5 and the M8 support the WiFi module, but the M3 does not.

The GPRS wireless network is normally used with ATT Wireless and is currently the most used network for credit card processing. So far I have not heard of development on the CDMA networks which would include Verizon and Sprint, but I imagine that there are plans in the future.

The M series terminals all include internal PINpads and thermal printers. They are compact, and use the same dual-processor system as the X terminals. Like X terminals, M series terminals accept normal credit cards as well as smart cards. The M series terminals aren’t the most elegant terminals out there, but it looks like Dejavoo traded fashion for a more robust and durable platform, which is far more important for wireless terminals.

Dejavoo WiFi Module

The Dejavoo WiFi module is an inexpensive USB WiFi stick that allows most Dejavoo terminals to process on a secure WiFi network. It theoretically works with the M3, M5, X5 and X8 terminals (We’ve personally only tested it with the X8, but Dejavoo has assured us that it works with the rest). We’ve been playing with one for the past week and despite some minor issues in initially getting the connection to work, it seems like this is the best only WiFi processing option available. The Verifone VX 610 is completely unusable because it’s support for WPA security is horrendous. The VX 670 is equally bad because it requires an expensive base, pushing the price above $800.

A note on wireless security and processing – WEP security is completely prohibited by PCI so do not under any circumstance use WEP or a non-secure connection to process using WiFi. Businesses should use WPA or WPA2 preferable and use a strong password like “4p%n&1GiJF$*nK8n”.

Conclusion

Based on our initial experience with Dejavoo terminals, they look to be the most promising brand of terminals we’ve seen in a long time, especially with regard to their wireless M-series wireless terminals. Several processors have made Dejavoo their preferred brand. I would like to see their performance over the next year or two before making a commitment. In any case, if I were Verifone or Hypercom, I would probably be concerned.  The Dejavoo terminals appear to be superior to both brands in just about every way including price, and only time will tell if they live up to their founder’s reputation.

Way Systems created their own terminal instead of using a re-manufactured Siemens phone. While they technologically regressed in some areas, they made a better product that works for what it is designed to do, process credit cards. By designing from the ground up they were able to use a single keypad for PIN debit processing (Their old models had 2 keypads due to encryption requirements). New features include the ability to add additional processing applications. Once certified, the terminal will support check services and gift cards through some select 3rd party providers. There are also no longer any log in/out requirements to use the terminal, and it has the ability to install new firmware when it becomes available. The new terminal still works with existing Way Systems infrared printers, and can now be charged through a mini-USB port. It is now supported by Apriva and eProcessing Network which allows it to be used with just about every US processor.

This terminal should be available early 2009, and should be a vast improvement to existing Way Systems 1581 terminals. If you were looking at purchasing a Way terminal, it would probably be better to wait for the way5000. We expect it to be about the same price as the 1581.

You can purchase the way5000 terminal from our main website.

Verifone is the second largest processing equipment manufacturer in the world, and their rivals Hypercom and Ingenico, have not made any moves to increase prices. Although this is only about a 5% price increase, I think that this will severely hurt Verifone’s reputation among banks and processors. Since banks and processors decide which terminals they make available to their customers, this could move to the point that Hypercom and Ingenico gain major ground on the US credit card terminal market. Hypercom’s most recent terminal line, is extremely competitive, and Verifone may have just opened the door for them to make a move.

Verifone’s stock has lost roughly 80% of it’s value since this time last year, while Hypercom has kept loses below 70%. I think this is a poor manner to handle a difficult situation. Verifone would have received a much better response by increasing the prices of their equipment instead of adding a fee to each one being sold. Sometimes the presentation is more important than the action, and I think that this may end up being one of those times.

Unlike Verifone and many other manufacturers, Hypercom realized that by making a single terminal with several versions, they can reduce their production costs, and make a superior product. Hypercom’s T42** and M42** line of terminals are exactly that, all the same terminal in form and operation, but with subtle hardware differences.

Hypercom’s T4210 is the most basic of the series and uses a standard dial connection. Stepping up, the T4220 is an Ethernet based terminal. Third in line, the T4230, is a retail (counter-top) based cellular terminal operating on AT&T’s wireless network. The M4230 is the same cellular terminal as the T4230 except it has a battery making it completely mobile. Last in the line, the Bluetooth enabled M4240, is battery powered and designed for hand-over processing such as pay-at-the-table.

This line of terminals is set to make a very strong stand against anything out there. They come in with a low price tag, and are high in features and usability. All include thermal printers, smart card capability, and internal PINpads. These are designed to be extremely easy to use, and all are identical to operate. This is a good thing, because businesses that want to upgrade within the terminal line, don’t have to learn any new operating procedures. Input ports are color coded, the printer cover opens with the push of a button, and there’s even a cable organizer to reduce cable clutter.

Hypercom thought these terminals through very well, and I think that they are going to be very popular once they are a little better certified. If you’re in the market for a new terminal because yours is going out or you need an upgrade, I highly recommend checking these out.

Ingenico and Hypercom are two of the largest credit card terminal manufacturers after Verifone. Verifone made a purchase of the Lipman corporation about a year and a half ago, which set their market share far ahead of any competitor.

The combination of Ingenico and Hypercom would create a company with an annual revenue of around 800M. Verifone is currently at about 2B so there is still a sizable gap, but this could create some real competition for Verifone.

Ingenico is less popular in the US than in other countries, but they make some very interesting products, and was one of the first to offer a reliable pay at the table solution. Hypercom is the number two terminal manufacturer in the US. Hypercom would be an excellent medium for Ingenico to grow their US presence.

I think that this would be a very smart acquisition for both Hypecom and Ingenico.

Here’s a few newer terminals that are finally catching up with technology, and style! My personal favorite is the Hypercom M4100, but several of these terminals are amazing.

Verifone VX 670

This the same terminal that Verifone uses for their pay at the table processing. This is a super fast battery operated WiFi terminal that is going to start getting very popular for high-end restaurants.

Verifone VX 810

The VX 810 is a high-end PINpad that is made in a hand-over design. Because of its high price for a PINpad, it’s unlikely that the 810 will ever become a mainstream PINpad.

Hypercom M4100

The M4100 is Hypercom’s answer to all other wireless terminals. It is made to compete with the ultra-compact terminals from Way Systems, Comstar and Apriva, but is rock solid and ready to use for any size merchant. It’s GPRS and WiFi enabled, includes an internal PINpad, and fits in a pocket.

Thales Artema Mobile

Thales terminals are not common in the US, but they are fairly popular in some other countries. The Artema Mobile is a GPRS wireless terminal with a printer and PINpad. It is one of the smallest wireless terminals available that has a printer attached.

Ingenico i7300 – i7910+

Ingenico has been making some very interesting terminals for several years, but most US processors do not support them. The i7*** series terminals come in just about any configuration a business would want, GPRS, WiFi, multi-terminal server, etc. These terminals are very small and have attached printers.

Exadigm XD2000

Exadigm is another brand that is rarely seen in the US. The XD2000 comes with an internal PINpad, smart card reader, and full size printer. It can be configured for dial, Ethernet, WiFi, Bluetooth, GPRS, CDMA, and runs on a very basic Linux operating system. It’s slightly larger than some other wireless terminals, but has more features available than any other terminal.

Blue Bamboo H50

The Blue Bamboo H50 is a compact terminal, that is full featured and is relatively inexpensive. This is a newcomer to the processing industry but the price, size and features, make it likely to gain popularity with some mobile businesses.

Way Systems 1581

This is the newest terminal from Way Systems and is scheduled to be in operation in the next few months. This appears to be a vast improvement over the functional, but ugly MTT 1551 and 1556, and is still based on a Siemens mobile phone.