There was a presentation at 32C3 this year where it was demonstrated, live on stage, just how woefully easy it is to get an eBay bought PoS device working with

There was a presentation at 32C3 this year where it was demonstrated, live on stage, just how woefully easy it is to get an eBay bought PoS device working with someone elses merchant account. Once you've done so, all you have to do is issue a 'refund' to a card you control, perhaps already stolen itself, and then go and withraw the cash. Another method, that was actually demonstrated, was to issue a mobile phone topup, which many of these multi-function terminals can do. Like most exploits, cybercrime isn't going to be enacted through a single flaw, but through systemic failure in the industry to give a shit before rolling any of this crap out.