Including MSP-ISO’s, POS equipment manufacturers and POS equipment providers need to remain aware of the Federal ADA Laws and PCI-POI requirements.
Issuing and acquiring banks should advise their cardholders and merchants of the importance of minimizing the risks of shoulder surfing.
Merchants should be made aware of how to professionally install the PIN entry device to provide a confident environment for the cardholder.
ISO 9564 is adopted by PCI and for PTS-POI is highly important to ensure implementation for PIN entry privacy for all POS device users.
Issuer communications with cardholders should include warnings against shoulder-surfing while entering their PINs, particularly in using their body and hands as a shield.
All retailers, for example, could include in their cashier training the topic of privacy shielding, stressing the dangers of shoulder surfing and the use of illicit cameras.
A warning sign or alert sticker encouraging cardholders to protect the entry of their PIN code should be displayed when PIN entry is awaited, or the message should appear on a permanent label near the PIN entry device.
Ensure your merchant base is educated in the positioning of the PIN Pads for POS Terminals. The PIN pad should ideally be positioned behind a fixed partition (such as the cash register) which shields it from the cashier’s view. PIN pads should generally be positioned on the side of the customer away from the queue, although care should be taken to ensure that it can be used easily by both right- and left-handed customers. If the queue is directly behind the customer, then the PIN pad should be placed directly in front of the cardholder.
In many situations, it is desirable that the PIN pad can be picked up and passed to someone unable to reach or use the PIN pad comfortably, such as a wheelchair user providing Privacy and the ability to self-PIN shield for PIN entry. Other disability needs can be for persons simply a very tall or short person. In these cases, requirements for handheld and portable devices apply can be a typical Verifone M-400 as an example.
Installing the PIN entry device on an adjustable stand allows cardholders to swivel the device sideways and or tilt it forward or backwards to a position that makes shoulder surfing more difficult.
Cashier and Cardholder Awareness Issuing and acquiring banks should advise their cardholders and merchants of the importance of minimizing the risks of shoulder surfing. Merchants should be made aware of how to properly install the PIN entry device to provide a confident environment for the cardholder.
Cardholder awareness is stressed in Annex C “Information for customers” of ISO 9564.
Issuer communications with cardholders should include warnings against shoulder surfing while entering their PINs, particularly in using their body and hands as a shield. All retailers, for example, could include in their cashier training the topic of privacyshielding, stressing the dangers of shoulder surfing and the use of illicit cameras.
A warning sign or alert sticker encouraging cardholders to protect the entry of their PIN code should be displayed when PIN entry is awaited or the message should appear on a permanent label near the PIN entry device. The following example or similar alert
sticker is recommended.