3 ms·

Thanks for this insight. During a low point in my career I took on some contract work to deploy new POS at some QSR. I had to visit the secret menu on the Ing

by kw71 12y ago

Thanks for this insight. During a low point in my career I took on some contract work to deploy new POS at some QSR. I had to visit the secret menu on the Ingenico card terminals to verify network settings and in some cases (when whatever provisioning process did not work) manually set them. The terminals were to communicate with a local device in a 10.* IP scheme, and were supposed to get their own network settings via DHCP. I've also had Walmart refund partial purchases without my payment card being present. This shows me that it's possible that Walmart stored the payment card information.

Nursie 12y ago
So there are a few things here I could maybe clarify, having worked in all sections of the chain from on-device security to issuing bank systems. (Remember I said maybe!) You're right, not all POS talk directly to the bank. One of the products I worked on was a store-level switch, the POS would talk to that. However the store-level switch did not have the requisite keys to decrypt all of the data the POS would put out. In particular there are some pieces of data (PIN is one) that must, by card-scheme rules, be encrypted from the point of entry all the way to the bank. The keys used to achieve this are injected into the terminal during manufacture or during an update process that can only be activated using further keys held by the banks, not at the store level. On your refund - Walmart may well be able to process a refund simply by specifying an amount and a transaction reference - they don't necessarily need to have had the card details to do that. Their bank can take that reference number and apply a refund against the transaction, looking up your account details in their database in order to inform your issuing bank about it. In some cases they may not even need to supply an account or card number to the issuing bank, just a transaction reference.

by kw71 12y ago

Nursie 12y ago

So there are a few things here I could maybe clarify, having worked in all sections of the chain from on-device security to issuing bank systems. (Remember I said maybe!) You're right, not all POS talk directly to the bank. One of the products I worked on was a store-level switch, the POS would talk to that. However the store-level switch did not have the requisite keys to decrypt all of the data the POS would put out. In particular there are some pieces of data (PIN is one) that must, by card-scheme rules, be encrypted from the point of entry all the way to the bank. The keys used to achieve this are injected into the terminal during manufacture or during an update process that can only be activated using further keys held by the banks, not at the store level. On your refund - Walmart may well be able to process a refund simply by specifying an amount and a transaction reference - they don't necessarily need to have had the card details to do that. Their bank can take that reference number and apply a refund against the transaction, looking up your account details in their database in order to inform your issuing bank about it. In some cases they may not even need to supply an account or card number to the issuing bank, just a transaction reference.