Apparatus and method for point of sale terminal fraud detection
A system, apparatus, method and computer programming for monitoring security of a payment terminal is described. There is provided monitoring of one or more security parameters associated with the payment terminal; detecting any violation of any one of the security parameters; classifying the detected any violation of the one or more of the security parameters into a classification; transmitting data regarding the any violation of the one or more of the security parameters, including the classification thereof, to a centralized terminal management server. If the any detected violation of the one or more of the security parameters is classified as potential fraudulent activity, there is also provided one or more security actions in response to the any detected violation of the one or more of the security parameters.
1. A method for monitoring security of a point-of-sale terminal, the method comprising:
(a) the point-of-sale terminal monitoring one or more security parameters associated with the point-of-sale terminal, a violation of any one of the security parameters being indicative of a compromise of the point-of-sale terminal;
(b) the point-of-sale terminal detecting any violation of any one of the security parameters,
(c) the point-of-sale terminal classifying the detected any violation of the one or more of the security parameters into a classification;
(d) the point-of-sale terminal transmitting data regarding the any violation of the one or more of the security parameters, including the classification thereof, to a terminal management server; and
(e) in response to the terminal management server classifying the any detected violation of the one or more of the security parameters as potential fraudulent activity, the point-of-sale terminal receiving from the terminal management server a command disabling functionality of the point-of-sale terminal,
wherein the one or more security parameters includes a power status of the point-of-sale terminal, and the detecting any violation of the any one of the security parameters includes the point-of-sale terminal detecting at least a power-up event at the point-of-sale terminal.
2. The method of claim 1 , wherein the one or more security parameters further include a network connectivity status of the point-of-sale terminal, the point-of-sale terminal maintains a network connection with the terminal management server, and the detecting any violation of the any one of the security parameters further includes the point-of-sale terminal detecting a termination of the network connection.
3. The method of claim 1 , wherein the one or more security parameters further include monitoring an access door to interior components of the point-of-sale terminal, and the detecting of any violation of the any one of the security parameters further includes the point-of-sale terminal detecting an opening of the access door.
4. A terminal management server for processing security event data of a point-of-sale terminal, the server comprising
a data transceiver configured to receive from a point-of-sale terminal the security event data indicative of a security violation detected at the point-of-sale terminal, the detected security violation being indicative of a compromise of the point-of-sale terminal; and
a data processor in communication with the data transceiver and configured to classify the detected security violation as potential fraudulent activity, and to cause the data transceiver to send a command to the point-of-sale terminal disabling functionality of the point-of-sale terminal,
wherein the detected security violation includes at least a power-up event at the point-of-sale terminal.
5. The terminal management server of claim 4 , wherein the terminal management server is configured to maintain a network connection to the point-of-sale terminal, and the detected security violation includes a termination of the network connection.
6. The terminal management server of claim 4 , wherein the data processor is further configured to cause the data transceiver to send a notification of the security violation, wherein the notification of the security violation is provided by at least one of an electronic mail and a SMS message to one or more recipients.
7. The terminal management server of claim 4 , further comprising a data storage medium in communication with the data processor and storing an expected time instant for an authorized power-up event, and the terminal management server is configured to classify the detected security violation as potential fraudulent activity from a comparison of a time instant of the power-up event at the point-of-sale terminal with the expected time instant for the authorized power-up event.
8. The terminal management server of claim 7 , wherein the data storage medium further stores an expected time instant for an authorized power-down event, the detected security violation includes a power-down event at the point-of-sale terminal, and the terminal management server is configured to classify the detected security violation as potential fraudulent activity from a comparison of a time instant of the power-down event at the point-of-sale terminal with the expected time instant for the authorized power-down event.
9. The terminal management server of claim 5 , further comprising a data storage medium in communication with the data processor and storing an expected time instant for an authorized network reconnection, the detected security violation includes a restoration of the network connection at the point-of-sale terminal, and the terminal management server is configured to classify the detected security violation as potential fraudulent activity from a comparison of a time instant of the restoration of the network connection with the expected time instant for the authorized network reconnection.
10. The terminal management server of claim 4 , wherein the detected security violation includes opening of an access door to interior components of the point-of-sale terminal.
11. The terminal management server of claim 4 , wherein the detected security violation includes removal of an internal component from the point-of-sale terminal.
12. The terminal management server of claim 4 , wherein the detected security violation includes tampering of an external casing of the point-of-sale terminal.
13. The terminal management server of claim 4 , wherein the command disabling functionality commands the point-of-sale terminal to discontinue processing of payment transactions at the point-of-sale terminal until an override authentication code is entered into the point-of-sale terminal.
14. The terminal management server of claim 4 , wherein the command disabling functionality commands the point-of-sale terminal to discontinue processing of payment transactions at the point-of-sale terminal above a set monetary amount.
15. The method of claim 1 , wherein the point-of-sale terminal transmitting data comprises the point-of-sale terminal transmitting a time instant of the power-up event at the point-of-sale terminal.
16. The method of claim 15 , wherein the point-of-sale terminal transmitting data further comprises the point-of-sale terminal transmitting a time instant of a power-down event at the point-of-sale terminal.
17. The method of claim 1 , wherein the detecting of any violation of the any one of the security parameters includes the point-of-sale terminal detecting removal of an internal component from the point-of-sale terminal.
18. The method of claim 1 , wherein the detecting of any violation of the any one of the security parameters includes the point-of-sale terminal detecting tampering of an external casing of the point-of-sale terminal.
19. The method of claim 1 , wherein the point-of-sale terminal transmitting data comprises the point-of-sale terminal transmitting the data when the point-of-sale terminal is powered down by an authorized user and/or when the point-of-sale terminal is powered up.
20. The method of claim 1 , wherein the point-of-sale terminal transmitting data comprises the point-of-sale terminal transmitting the data in real time with the point-of-sale terminal detecting the any violation of the one or more security parameters.
21. The method of claim 1 , wherein the point-of-sale terminal transmitting data comprises the point-of-sale terminal transmitting transaction data to the terminal management server, the transaction data comprising data generated by the point-of-sale terminal based on a payment transaction and the data regarding the any violation of the one or more of the security parameters.
22. The method of claim 1 , wherein the command disabling functionality indicates the point-of-sale terminal is to be deactivated, and in response to the command disabling functionality the point-of-sale terminal discontinues processing of payment transactions at the point-of-sale terminal until an override authentication code is entered into the point-of-sale terminal.
23. The method of claim 1 , wherein the command disabling functionality indicates the point-of-sale terminal is to be deactivated, and in response to the command disabling functionality the point-of-sale terminal discontinues processing of payment transactions at the point-of-sale terminal above a set monetary amount.