Jost Stollmann, the CEO of Tyro (fast broadband eftpos), wrote to all software companies which integrate their software with the Tyro eftpos solution about the recent reports of fraud using eftpos terminals. I publish his note here in full as it provides excellent information to consider.

We completed our Tyro integration earlier this year and already have well over 200 retailers using this.  This is growing weekly thanks to excellent word of mouth around the speed, savings and, security…

In recent press you may have seen headlines alerting Australians of a card payment scam that was discovered in a West Australian multinational fast-food restaurant chain. Something like 3,500 customers seem to have been defrauded by $4 million. What about your merchants? Are they exposed without knowing?

This is a check list for their peace of mind that I sent them:

1. Have your acquirer guarantee that his terminals are PCI PED and EMV 4.0 certified! All Tyro terminals are. They are the newest generation protected against eavesdropping, tampering or message forgery. All sensitive information is protected, and instantly erased if the terminal is tampered with.

2. Have your acquirer guarantee that no card holder data passes on to any PC, for instance residing in memory in the clear! With Tyro’s integration technology, no card or PIN data is ever passed on. It never reaches your Point of Sale (POS) software. Therefore, even if malicious data capture software was to be loaded onto your POS, it would not be possible to capture, store or transmit confidential card data.

3. Have your acquirer guarantee that card holder data is never transmitted in the clear! With Tyro’s technology, any transmission occurs only encrypted through an-end-to-end secured connection between our PCI PED certified terminal and our PCI DSS compliant switch, and it is using totally safely the public internet.

Sorry, if this sounds a little like bragging on about ourselves, but we are dead serious. The reality is that most EFTPOS terminals transmit card data in the clear. Integrated EFTPOS solutions hold card data in memory in the clear. We think it is most important to protect merchants and card holders against the increasingly sophisticated fraud industry. It is also important to maintain the consumers trust in the card payment industry.

Tyro is the only new entrant into the Australian payment industry. We are leading the industry in security. So, if you want to protect your merchants and their customers from card data security breach, possible scheme fines and potentially catastrophic reputation damage to their business and to the industry, recommend Tyro to them. If you are not yet integrated with us, what are you waiting for. If you are help us spread the word and recommend us to your customers. Thank you for your consideration.

Tyro is integarted with newsagency software from Tower Systems.  Our Tyro integration delivers tangible benefits: saving time, cutting mistakes and saving money - in addition to enjoying better security.

Disclosure: Tower Systems receives a small clip from transactions through Tyro, this funds support and link development.

Last month, we quietly released enhanced security facilities in our point of sale software.  The new facilities focus on reducing employee and customer fraud against businesses using the enhanced software.

Months in development, the enhaanced security facilities are truly state of the art and unique to our software in our marketplaces.  Our work has been done in association with experts in retail security.

We know that fraud / theft in retail costs between 3% and 5% of turnover.   Risk of discovery is key to reducing the cost to a business.  Our enhanced facilities provide the business owner with better facilities with which to discover a problem.

Our POS software integrated security camera system has helped another of our customers address a theft problem.  While many systems claim to be integtrated with point of sale software, few are.

In this latest incident, we were able to help our customer catch someone scamming the business with bogus refund requests.  While the amount involved this time was relatively small, providing a consistent process for retail staff to follow can save a business thousands of dollars a year.

We are close to releasing an enhanced security bridge between our retail management software and the security camera system with which we link which will enhance further the Tower Systems security offer.

We are about to start live testing of a significantly enhanced security bridge.  This bridge between our software and smart image recording technology is exclusive in our software - it enables our retailers to search image footage by transaction type, content and staff member.  This reduces the time spend reviewing footage in search on any event of concern.

We first released our secruity bridge six years ago and it has undergone significant change since.  The latest changes take the marriage of security management facilities and point of sale facilities to a new level.  We are grateful to technology developers overseas who have provided deep access to their image capturing systemto enable our new bridge to be built.

Once the in-field tests are completed we will release the bridge for general use.

We yesterday completed a review of the handling and storage of customer credit card details processed through our point of sale software given the current tightening of security standards being driven by Australian banks.  Our software meets these tight standards. 

Our software, porcesses and standards have been passed by Australian banks as well as other international parties whose standards we must meet given some of the transactions we process. 

That we meet today’s standards including the PCI DSS standard offers peace of mind to current Tower Systems customers and prospective customers.

The PTZ (Pan, Tilt, Zoom) camera is a popular component of our point of sale integrated camera security system. It can be accessed and manipulated from anywhere in the world by anyone with an appropriate security clearance for access through the internet to the business. From a remote location you can see into the shop, pan to 360 degrees and zoom to ten times. This is fantastic flexibility. Customers who install the PTZ camera enjoy the flexibility they have in watching the business at key times when they are unable to be in-store live.

Our software allows you to get straight to video of specific transactions based on date and time, items sold, staff member or other criteria. This flexibility can save hours of time you might otherwise spend looking at video footage. We are enhancing our video links to further improve these facilities - these latest changes are on the back of advice from our users.

We were the first to introduce point of sale / security linked facilities years ago and to offer data driven video search capabilities.

The security camera / CCTV marketplace is cluttered.  There are back of the car operators offering security systems for $2,000, even less.  There are high end players offering systems for $20,000 and up.

The jargon around security systems makes the market one which is attractive to people light on ethics.  They can through in some cool sounding terms, win confidence of an unsuspecting small business person, sell some kit for a few thousand and pocked two thirds of that as profit.

One retailer I was talking with last night fell for this.  She paid $4,500 for a four camera system which is not even worth a fraction of that.   The cameras are poor quality, one is not even connected.  The frames per second rate is very low, meaning that only a series of stills is captured.  Some checking revealed that the company from which the business bought the system does not exist, the owner/salesperson/installer is not contactable.

Small business owners ought to be careful if considering a security / CCTV system.   It is a complex business which requires specialist skills and, in some states, certification.  We have been in this space for the last six years with our fully point of sale integrated solution.  Part of our work can involve work with existing security installations.  This is where we get to see the practices of others.

As the warning goes, caveat emptor - let the buyer beware.

Firewalls are problematic for users, software providers and others supporting the systems. Everyone wants settings their way. A change here and impact a connection from somewhere else. When you;re dealing with small business owners who do what they are told in this area, you can quickly find yourself with operational problems because one supplier connecting to the system has demanded firewall changes which cause another to be compromised in their access.

The cost of managing secure access to a small business system is growing as more suppliers connect directly with the business. We have small business customers with regular direct online access with an many as eight companies and all it takes is for one of those to demand a change and the others may have a problem. We have produced a standards document to try and navigate this but some suppliers don;t care - it’s their way or no way.

Some days, twenty percent or even more of support calls we take are firewall related - not to do with our software as such. The calls come to us because the supplier involved usually does not want to help, the supplier of the firewall can’t help with industry knowledge and the industry itself has no central approach to managing these things.

Security is important. I wonder if economists have costed everything associated with data security for a small business.

A picture tells a thousand words as they say. It is true in court where you are trying to prove a case of employee theft. Take a look at the image below. Even though we have staged this, it shows the video footage and data from our point of sale software proving what was happening at the time - a canceled sale. This is hard evidence, proof of a crime and it is available directly from within our point of sale software using our exclusive theft bridge technology.

Users of our technology can go into their system, call up a list of canceled sales (ot other suspicious activity) and in an instant have the data and vision marriage on the screen. It’s brilliant. More than that, in most businesses it pays for itself in no time since customer and other disputes are settled quickly and accurately.

Our link was a first and now we are enhancing it, new features will keep us in our own league in the mission to cut the cost of theft in small business.

Yesterday was one of those days when a key issue dominated. The issue was employee theft. Not here, but in businesses in which our software is used and elsewhere among small businesses. It started with a call from a customer concerned that something may not be right.

As is the case with these things, I’d tend to receive the call - an owner to owner call appears less stressful than them discussing what they see as failure with someone on our Help Desk. In a few minutes he had enough evidence from his system to make contact with the police.

Next was a call from a police officer we are helping prepare a case on behalf of a client. There were questions about keystroke patters and how these are reliable indicators of theft or fraud.

In the afternoon I was interviewed for an article about theft in small business and as is often the case with such interviews, one comes away better informed thanks to good questions.

Early in the evening was a call from an employee asking the wrong question of the wrong person - I’ve let the owner know that they need to take control back over their data by protecting high level passwords more.

Theft management tools, while not our core product, are important to what we do. They help our customers reduce the cost of theft in their business. Beyond the tools, however, is the service we provide - encouragement and guidance on addressing the issue. We have learnt from our own experience in retail that theft is part of the turf. How you manage it can make or break you.

A more recent part of our business is our theft management solution - digital cameras connected through a server based smart card and tightly interfaced with our POS software. It’s a high end solution for retailers wanting to more efficiently manage employee and customer theft. The key benefits of our solution are that we dramatically cut the time taken to track theft and we help quickly provide video evidence of situations tracked by our POS software. It’s an ideal application marriage.

We’re not too noisy at promoting our security camera system because, frankly, we’re pretty busy at present and these systems are labour intensive to install.

The break has given us an opportunity to reassess our pitch. This reassessment has meant we have looked at how others pitch their offerings. It’s a dirty marketplace. By that I mean just about every man and his dog offers a security camera system. The problem is, not all of these offerings are suitable and it is very easy to dazzle a prospect with jargon and pretty pictures. below I have put together a list what I’d suggest you avoid if you are looking for a system:

Tape based systems - they’re so yesterday’s technology.

Systems which do not provide easy searching of archive footage based on items purchased.

Systems not deeply integrated with your POS system.

Systems which require you to watch hours of footage looking for what you want.

Systems from companies less than five years old.

Systems from companies which do not provide reference sites.

Systems offering a package deal which seems too good to be true - it probably is.

People more expert than me will have their own list. The key is to research your purchase well. B sure to talk with people using the system.

The time you want the very best system is the time you are chasing evidence for an expensive crime. Scrimp today and solving the crime might cost more than you saved on a system.