Point of Sale (POS) terminals

Point of Sale (POS) terminals

[ From chapter-11 of the book "Information Technology in Banking" written by Abul Kashem Md. Shirin and Nusrat Tamanna Prianka and published by Institute of Bankers, Bangladesh (IBB) ]

1.         What is POS terminal?

POS stands for Point of Sale. POS terminal is a small device installed by a bank at shops, hotels and offices of a merchant. The customer buys the good and services from the merchant, and if wants to pay the bills using his debit/credit card, the merchant uses the POS device to swipe or insert the card for settlement of his bill.

POS terminals are intended for processing transactions at merchant locations with use of plastic cards with a magnetic strip and smarts-cards. Configuration of POS terminals vary over a wide range, however the typical modern terminal is supplied with devices for reading smarts-cards and magnetic strip, ports for connection of PIN PAD (or built-in PIN PAD), the printer, connection with the PC or with an electronic cash register.

Besides usually the POS terminal is equipped with a modem with a capability to call-back. The POS-terminal can be programmed. This allows on-line authorization of cards. Finally the communication is passed to Data Centre. During a session of connection, the POS terminal can accept and remember the information transmitted by the Server of the Data Centre.

A POS terminal can communicate with Data Center using PSTN line or GPRS. PSTM POS terminal requires a telephone line for communication whereas the GPRS POS terminals uses mobile SIM card for communication. When a card is swipe (in case the card is meg-stripe) or inserted (in case the card is EMV) the POS terminal dial to a set number and get connected with the modem pool of Data Center (called NAC – Network Access Controller). After connection, the exchange of information happens.

GPRS POS terminal has advantages over a PSTN POS terminal. A GPRS POS terminal can be moved anywhere as it has SIM and built-in battery.

2.         Transaction types supported at POS terminals

A merchant can perform following transactions using a POS terminal:

Sale:  Customer pays for merchandise or service from his/her account.

Void: Before end of day (Settlement), merchant can cancel the sale and give the money back.

Refund: After end of day (Settlement), merchant can cancel the sale and give the money back.

Pre-authorization: Merchant can block some amount of money from the customer's account for a specific time. It is usually used in hotels. Merchant guarantees to get money for the services.

Cash Advance: Customer can use POS to get money from the account. Merchant will give the money to customer instead of goods or service. This is like using POS as ATM to get the money from the account.

3.         POS Specifications:

Brand: Three popular brands of POS terminals are: Hypercom, Verifone and Ingenico. The available models are: Hypercom – T7, T7 Plus, Optimum T2100 (PSTN), Optimum M4230 (GPRS); Verifone – Omni 3750, Vx 510;  Ingenico – i5100 (PSTN) and i7910 (GPRS).

RAM: 2 MB – 8 MB Flash

Processor: ARM 32 bits / 32 bits RISC

Magnetic Card Reader: ISO 1/2/3

Smart Card Reader: EMV level 1 & 2 and ISO 1/2/3

Encryption: Triple DES

Printer: Thermal,

Display: Graphic, 128x64 pixels; Backlight

Communication: GPRS / PSTN

4.         How POS works?

A POS transaction is a purchase that begins with a cardholder. The diagram below will help us better understand the transaction process. Essentially, the transaction process is a series of purchases, beginning with the cardholder:

a)      The cardholder purchases goods or services from the merchant.

b)      The merchant, in effect, sells the transaction to the "acquirer" and is reimbursed the amount of the sales ticket less a "discount fee."

c)      The acquirer then submits the transaction to the issuing bank for payment via Payment Association’s (i.e., VISA, MasterCard etc.) interchange and settlement system.

d)     The issuing bank pays the merchant acquirer, less an interchange fee which partially reimburses the issuer for its expense, through Payment Association’s settlement system.

e)      Finally, the cardholder repays the issuer for the goods or services originally purchased from the merchant.

 ? Figure: How POS terminals works

5.         POS terminology

a)         PIN pad:

A PIN pad is required with the POS terminal for cardholder to insert and encrypt his PIN. To accept Debit card at the POS terminal, the POS terminal must have separate or built-in PIN Pad.

b)         Insert and Swipe:

A non-EMV card needs to be swipe in the POS terminal whereas an EMV card needs to be inserted in the POS terminal.

c)         Merchant Commission:

A commission in percentage on the sale value, which the merchant pays to the bank that supplied the POS terminals. If a merchant sale an item at a cost of Taka 100 and the cardholder pays the bill using his card, the bank receives Taka 100 from the cardholder, but pay Taka 98 to the merchant, if the merchant commission mutually agreed is 2%.

d)         Interchange fee:

Interchange fee for POS is the fee which the acquiring bank pays to the issuing bank. This comes into picture if a cardholder of a Bank pays bills at a merchant location where the POS is supplied by another bank. The interchange fee is fixed by the payment associations, such as for MasterCard, this is 1.16% (if card is non-EMV). In the above example, the acquiring bank will earn 2.0% commission, but as the cardholder is of another bank, the acquiring bank has to pass on 1.16% of the sale value to the issuing bank.

6.         Number of POS terminals in operation in Bangladesh (in year-2010):

Bank/Inst. Name	No. of POS	POS Brand	POS Model
SCB (Merchant Solution)	2500	VeriFone	Omni 3750
National Bank	1500	Hypercom	T 7, T 7 Plus, Optimum T2100, Optimum M4230
Prime Bank	700	Hypercom/ Ingenico	T 7, T 7 Plus, Optimum T2100 / i5100
Q-Cash Consortium	100	VeriFone	Omni 3750
The City Bank	4200	VeriFone/ Hypercom	Omni 3750, Vx510/ Optimum M 4230
Dutch-Bangla Bank	2600	Hypercom/ Ingenico	T 7 Plus, Optimum T2100 / i5100, i7910
Brac Bank	1500	Creaon / Hypercom	Spectra/ Optimum T2100, Optimum M4230
Premier Bank	80	Hypercom	Optimum T2100
Lanka Bangla Finance	400	Hypercom	T 7, T 7 Plus
	13580

7.         Fraud at POS and remedy

In the POS terminals, Counterfeit Cards are used for payment against purchase of goods which the fraudsters can easily sale in market (such as gold and electronic items) to get the cash in hand.

A counterfeit card is one that has either been created from scratch by criminals using real or fake card numbers or is a valid card that has been altered.

The majority of counterfeit card fraud finds its source from skimming, the process whereby legitimate card details are recorded from a card’s magnetic strip and are subsequently encoded onto a fake card by the criminals. Skimming is normally perpetrated by retail staff who record card details using pocket sized recording units before returning the valid card to the cardholder during a sale. They then sell the recorded information to organized criminal groups, who make the counterfeit cards. However, the use of skimmed data is not limited to the production of fake cards for use in card present environments. The information is also used to undertake fraudulent card not present transactions (e-commerce transaction) with false delivery addresses.

Once the card data is in hand, the fraudsters produce a physical card with a bank name, his own name, picture and signature. However inside the meg-strip, he uses the card information of the victim. After shopping when he place the card at the merchant, the merchant finds that the photograph and signature is perfectly matching. However the POS has got another set of information. The POS will send this information to the acquiring bank, which will forward the transaction to the victim’s bank (issuing bank). The issuing bank will find everything in order and authorize the transaction. As such the merchant will hand over the items to the fraudster.

The merchant, after closing his POS batch, will get his money in his account from the acquiring bank. The acquiring bank will also get money from the issuing bank. However when the cardholder will get his account statement, he will deny to pay this money as he has not made this transaction.

Investigation will start. One of these two banks will have to absorb the loss. If any of them is EMV compliant, it will win. If both the banks are non-EMV, then who will bear the loss? Payment association will decide. If both the banks are EMV complaints, this will never happen.

Therefore to prevent the cards being counterfeit, the customers, merchants, banks and payment associations need to undertake some precautions described at module-B: Chapter-9 under the heading “9. Plastic Money Fraud Prevention Strategies”.