Skip to main content

Card-Present Terminal Decisions

Prerequisites

Before selecting terminals, understand:

Terminal choice affects your liability, fees, and fraud exposure. The wrong terminal costs you more than the hardware.

Most SMBs pick based on price or what their processor bundles. Then they discover limitations six months later.

What Matters​

  1. EMV chip transactions shift liability. If you accept a dipped chip card and it's fraudulent, the issuer eats it. If you swipe, you eat it.
  2. Contactless is expected. Customers increasingly tap. If you can't accept tap, you look dated.
  3. Keyed transactions are high-risk. Every keyed entry is a liability and fraud exposure.
  4. Terminal security is your problem. Tampered terminals mean stolen cards and your account shutdown.
  5. Omnichannel needs planning. If you sell online too, unified processing matters.

EMV vs. Contactless vs. Swipe​

EMV (Chip Dip)​

AspectDetails
SecurityHighest for card-present. Chip generates unique cryptogram per transaction.
LiabilityFraud liability shifts to issuer when chip is read.
Speed2-4 seconds. Slightly slower than tap.
Customer expectationStandard. Everyone expects chip readers.

Contactless (Tap)​

AspectDetails
SecuritySame cryptogram technology as chip.
LiabilitySame liability shift as EMV.
Speed1-2 seconds. Fastest card method.
Customer expectationGrowing. Post-COVID, many prefer no-touch.
RequirementsNFC-enabled terminal. Most modern terminals include this.

Swipe (Mag-stripe)​

AspectDetails
SecurityLowest. Static data, easily cloned.
LiabilityFraud liability stays with merchant.
SpeedFast, but irrelevant given liability.
When acceptableFallback only when chip fails. Should be rare.

Rule: Chip and tap always. Swipe as last resort.

Mobile POS Options​

Mobile POS (mPOS) means a card reader connected to a phone or tablet.

When Mobile POS Works​

  • Mobile businesses (food trucks, market vendors)
  • Pop-up retail
  • Service businesses at customer locations
  • Low-volume retail testing a location
  • Backup terminal when primary fails

When Mobile POS Doesn't Work​

  • High-volume retail (too slow, battery issues)
  • Situations requiring receipt printer integration
  • Complex inventory/POS needs
  • Unreliable phone connectivity

Common Mobile POS Options​

DeviceBest ForNotes
Square ReaderVery low volume, simplicityLocked to Square ecosystem
Stripe TerminalDevelopers, omnichannelMore technical setup
PayPal ZettlePayPal users, low volumeLimited customization
Clover GoSMBs wanting Clover ecosystemHardware leasing traps

Mobile POS Trade-offs​

ProCon
Low upfront costHigher per-transaction fees
PortableBattery dependent
Quick setupLimited integration
Good for testingMay outgrow quickly

Countertop Terminals​

Traditional terminals that sit at checkout.

Key Features to Require​

  • EMV chip reader
  • NFC/contactless
  • PIN pad (for debit)
  • Internet connectivity (Ethernet preferred, WiFi fallback)
  • Receipt printer (built-in or separate)

Key Features to Evaluate​

FeatureWhy It Matters
Dual-facing screenCustomer can see amount, enter PIN, tip
Integrated printerFewer failure points
Battery backupContinues during brief power outages
PCI PTS certificationSecurity compliance

Terminal Locking​

Some processors bundle "free" terminals that only work with them. When you leave:

  • Terminal becomes paperweight
  • No token portability
  • Forced to start over

Ask before accepting bundled hardware: "If I switch processors, can this terminal work with others?"

MOTO/Keyed Transaction Risk​

MOTO (Mail Order / Telephone Order) and keyed transactions are high-risk.

When Keyed Entry Is Acceptable​

  • Established B2B customer calling with a repeat order
  • Card present but chip won't read (1 attempt only)
  • Phone orders with verified existing accounts

When Keyed Entry Is a Red Flag​

ScenarioRisk
Walk-in customer says chip "doesn't work"Possible counterfeit or card testing
Employee keying cards at end of shiftPossible collusion or internal fraud
High keyed ratio at one register/employeeInternal fraud signal
Keyed transactions for pickup ordersCard may not be present at all

Liability Shift Loss​

Keyed transactions do not get EMV liability shift. If the charge is fraudulent, you eat the loss.

Employee Training​

Train staff:

  • Never key a card if the customer refuses to try chip/tap
  • If chip fails twice, ask for different card
  • Document why any keyed transaction was necessary
  • Never key a number read over the phone by a walk-in customer

Monitoring Keyed Ratio​

Track keyed transactions as percentage of total CP volume.

RatioStatus
< 2%Normal. Cards occasionally fail.
2-5%Investigate. Check by employee.
> 5%Problem. Review immediately.
Ask Your Dev

"Can we pull a report showing keyed transaction percentage by employee or register?"

Device Fleet Hygiene​

If you have multiple terminals, fleet management matters.

Reader Labeling and Inventory​

  • Label each terminal with unique identifier
  • Track serial numbers and locations
  • Know which terminal is at which register/location
  • Maintain spare for quick replacement

Connectivity Best Practices​

ConnectionProCon
EthernetMost reliable, fastestRequires wired infrastructure
WiFiFlexible placementInterference, security concerns
Cellular (LTE)Works anywhereMonthly cost, slower
Bluetooth to phonePortableBattery dependent, pairing issues

Recommendation: Ethernet for fixed locations. Cellular for mobile. WiFi as middle ground.

Firmware Update Cadence​

  • Terminals require firmware updates for security and features
  • Schedule updates during off-hours (after close or before open)
  • Test after update before peak hours
  • Some processors push updates automatically (verify this is happening)

Offline Mode Risks​

Many terminals can accept transactions offline and batch-upload later.

Risks:

  • Offline transactions have no real-time auth
  • If card is actually declined, you don't find out until batch
  • Fraud risk is higher
  • Weekend offline batches can mean Monday surprises

Guidance: Disable offline mode unless absolutely necessary. If required, set low limits.

Battery and Charging Discipline​

For mobile and battery-backup terminals:

  • Charge overnight
  • Replace batteries proactively
  • Don't drain to zero (damages battery)
  • Have backup charger/battery

When a Reader Disappears from Dashboard​

If a terminal stops appearing in your processor dashboard:

  • Check power and connectivity first
  • Verify firmware is current
  • Check if it was reassigned or removed
  • Contact processor support if unresolved
  • Consider it potentially compromised until explained

IVR/Phone Payment Risk​

Taking card numbers over the phone creates PCI scope and fraud exposure.

PCI Scope Implications​

If staff hear or transcribe card numbers:

  • Your environment is in PCI scope
  • Call recordings with card data are violations
  • Systems that display card numbers need protection

Authentication Challenges​

Phone payments have:

  • No 3DS option
  • No device fingerprint
  • No address verification at point of call
  • Only CVV as protection

Fraud Patterns​

PatternDescription
Social engineeringFraudster calls claiming to be customer, provides stolen card
ATO via supportFraudster calls to add card or change details
Employee collusionStaff takes card info for personal use

When Phone Payments Are Acceptable​

  • Established B2B relationships with known contacts
  • Follow-up to in-person transaction (card failed, callback with different card)
  • Low-ticket, low-risk items

Better Alternatives​

Instead of PhoneDo This
Customer reads card over phoneEmail/text a payment link
Staff keys card numberSend hosted checkout link
Repeat B2B orders by phoneSet up on-file billing

Related: Invoicing

Omnichannel Considerations​

If you sell in-person and online, unified processing simplifies everything.

Benefits of One Processor for Both​

BenefitWhy It Matters
Unified reportingOne dashboard for all transactions
Single reconciliationOne deposit, one statement
Token sharingCards saved online work in-person and vice versa
Consistent pricingNo managing two rate structures

When Separate Processors Make Sense​

  • Specialized CP processor with better terminal support
  • Legacy in-person setup that works, new online launch
  • Temporary while migrating

Omnichannel Pitfalls​

  • Different merchant IDs for CP and CNP can confuse reconciliation
  • Customer disputes may land in wrong system
  • Token portability between channels isn't automatic
  • Reporting gaps between systems
Ask Your Dev

"Are our in-person and online transactions on the same merchant account? Do saved cards work across channels?"

Terminal Security​

Terminal tampering leads to card skimming, data theft, and account termination.

Tamper Inspection Checklist​

Weekly check:

  • Terminal casing intact, no unusual gaps
  • Card slot matches original design
  • No overlay on PIN pad
  • No loose cables or wires
  • Tamper stickers/seals unbroken
  • Serial number matches your records

Physical Security Basics​

  • Terminals should be visible to staff, not hidden
  • Cable terminals to prevent grab-and-run theft
  • Limit who can access back of terminal
  • Lock terminals in safe overnight (high-risk locations)

What to Do If Tampering Suspected​

  1. Stop using the terminal immediately
  2. Do not process transactions
  3. Contact your processor security team
  4. Preserve the terminal as evidence
  5. Review recent transactions for anomalies
  6. File police report if theft confirmed

Test to Run​

2-week terminal audit:

Week 1: Baseline and inspect.

  • Pull keyed transaction percentage by terminal/employee
  • Inspect all terminals for tampering
  • Verify firmware is current
  • Check connectivity type and reliability

Week 2: Remediate and measure.

  • Address any high keyed ratios
  • Update firmware if needed
  • Fix connectivity issues
  • Re-check keyed ratio

Success criteria: Keyed ratio under 2%, all terminals current on firmware, no tampering signs.

Scale Callout​

VolumeFocus
Under $100k/mo CPGet a basic EMV/NFC terminal. Square or Stripe Terminal are fine. Don't overthink it.
$100k-$1M/mo CPFleet management matters. Standardize terminals, track keyed ratios, schedule firmware updates.
Over $1M/mo CPMulti-location consistency, dedicated terminal support, employee training programs, regular security audits.

Where This Breaks​

  1. Multi-location businesses with inconsistent terminal versions. Old terminals at some locations create liability gaps and reporting inconsistencies.

  2. Mixed CP/CNP with reconciliation complexity. Separate merchant IDs for channels creates accounting headaches.

  3. High-turnover staff requiring constant retraining. Security and procedure training gets neglected with frequent staff changes.

Analyst Layer: Metrics to Track​

MetricWhat It Tells YouTarget
Keyed transaction %Liability exposure and fraud risk< 2%
EMV dip vs. tap ratioCustomer preference, terminal capabilityTrack trend
Offline transaction %Batch risk< 1% or 0%
Terminal uptimeHardware reliability> 99%
Chargeback ratio by channelCP should be lower than CNPCP < 0.3%

Next Steps​

Choosing terminals?

  1. Compare EMV vs contactless vs swipe - Know the trade-offs
  2. Evaluate mobile POS - When mPOS works and doesn't
  3. Check countertop features - What to require

Managing existing fleet?

  1. Monitor keyed transaction ratio - Under 2% target
  2. Implement tamper inspection - Weekly checks
  3. Follow fleet hygiene - Labeling, connectivity, firmware

Concerned about security?

  1. Train employees on keyed transactions - When to refuse
  2. Secure physical terminals - Cable, lock, visible
  3. Know response protocol - Stop, preserve, report