BYOD and Smartphones as POS Terminals Don’t Mix!

Paula Musich

Summary Bullets:  

• Retailers should resist the urge to have employees use their own smartphones or tablets as point of sales terminals for credit card transactions
• Mobile malware has a fast growth trajectory, and retailers are a prime target for cybercrime

Here’s a really terrible idea: retailers allowing employees to use their personal smartphones or tablets to process credit card transactions on behalf of their employers. This caught my eye recently after the PCI Security Standards Council released its “PCI Mobile Payment Acceptance Security Guidelines for Merchants as End-Users” document, which does not recommend that activity as a best practice. Now there’s an understatement. Just because there’s an app for that doesn’t mean it’s a good idea to allow just any smartphone or tablet to act as a point of sale (POS) device in the retail world. The PCI Security Standards Council rightly pointed out to merchants that they have an end-to-end responsibility for the mobile app employed to process payments, the back-end processes and the security of a device that in this case they would not own.