Sensitive Authentication Data (SAD)

Is the security-related information of a payment card that is used to authenticate cardholders and authorise payment cards transactions.

SAD includes the security code, PIN, full magnetic-stripe data and the dynamic CVV.

It is prohibited to store SAD once the payment has been authorised.

When you get your card machine you should check for signs of tampering of the equipment. It is strongly advised that these checks are performed regularly after receipt.

“Skimming devices” sweep up your customers’ payment card data off the magnetic stripe when swiped through a card reader or use contactless payments. Hackers use the data to create counterfeit cards and make illegal purchases. 

Typically, a skimming device installed in your point-of-sale (POS) are difficult to spot.

Here are three simple steps to help you spot a skimming device.

1. Confirm your hardware. A legitimate terminal’s serial number attached by sticker on the underside should match the electronic display. If they’re different, there may be a skimmer inside.

2. Look for odd changes. If someone removed a terminal’s bottom cover plate to insert a skimmer, they often removed or damaged security stickers placed over screw holes or seams. Some attackers replace terminal cables with an infected variation (e.g. straight vs. curly). Others might place an extra device for skimming next to your terminal. Take a photo of new equipment and periodically cross-check the entire point-of-sale with the photo to confirm there are no changes. 

3. Be cautious of unannounced service visits. A so-called “friendly tech” may be an attacker looking to sneak in a skimming device.

4. Error Messages. Your card machine detects any ‘tampered state’. In this state your card machine will repeatedly flash the message ‘Alert Interruption!’ and further use of your card machine will not be possible. If you observe the ‘Alert Interruption!’ message, you should contact your card machine help desk immediately.

5. Access to the POS. Ensure card machines are stored in a secure location when not in use or the college is closed.