The Complex Environment of Unattended Credit Card Readers

Credit Card Readers for Unattended

The current environment for credit card readers gets more complex every day. Not only from a deployment standpoint but also as retro upgrades. Four years from now whatever you put out now, you will likely want to switch then. Kiosk and terminal manufacturers don’t have the option of a clean VESA mount like LCDs and touchscreens do. Mounts come in all flavors.

Historically too deployers have “cheated” with POS devices just like they cheat with assistive technology. The rationale used is “we have people available to help”. For larger companies they just exact a guarantee of limited liability using a device NOT rated for unattended. SMBs take it on the chin. In assistive tech, it becomes “we are providing meaningful access” legally albeit in violation of Title III for same service.

What we think about:

mitigating all of the different mounts so present and future is easier
Does the KMA raise that as relevant action item to review?
Why does PCI SSC ignore accessibility and assistive qualities?
Why does PCI SSC ignore companies that use attended devices instead of unattended? Enforcement?
Processors and POS systems could encourage proper card reads by using fees (that only go up)
Companies like Ingenico have made strides but Verifone seems stuck.
NRF tried Javapos and other methods to standardize middleware connections (think CUSS and Java)
Hotels and restaurants unite?
Cheap slow credit card readers should be replaced.

We asked some experts about it.

Looks good to me. Although, one comment I have is that we have many partners leveraging semi-attended installs for merchants of all shapes and sizes and we’ve never really had pushback from the processor for boarding the accounts. In fact, strangely enough one of the most popular devices used by our kiosk provider partners is a mounted Ingenico LANE/3000. OEMs like Touch Dynamic, PartnerTech, Pye, and others standardize on mounted countertop devices for their kiosks – against our recommendations since we support purpose-built unattended products as well and recommend those for any unattended use-case. I have received feedback that the mounts for attended devices are surface-mount friendly (and therefore easier to swap), whereas the purpose-built unattended devices require custom casework because they’re designed to be more integrated. We see this in amusements, fast-casual/QSR kiosk ordering, lighter-use vending, ticketing, cafeteria, municipal kiosks, etc…

Couple of hardware OEMs that standardize on countertop hardware for their kiosks.

- Touch Dynamic
- PartnerTech
- Pye

Just wanted to weigh in since this is pretty prevalent among hardware OEMs that cater to a variety of POS providers.

And another

Yes, the article looks good to me as well. I would suggest expanding a bit on what xxxxxx mentioned regarding the mounting of attended versus unattended terminals. Experienced kiosk companies often incorporate modularity into their designs by using removable block plates. This allows for the flexibility to use different unattended devices on the same kiosk by simply changing the block plate, rather than replacing the entire cabinet door. In fact, I would argue that switching between different attended devices on a kiosk requires nearly the same level of engineering.

And another

Hi xxxx. I agree with Jared that semi-attended has become much more commonplace as the years have progressed since we had that original conversation. To me now the use case and environment the kiosk will be placed into is the biggest deciding factor between using an attended or unattended terminal. I added a chunk of sentences addressing that point. I added some additional info and edits to make some of the statements less matter-of-fact and more up to the reader’s interpretation. Thanks for the shout out.

Here is original instigator (super major kiosk manufacturer)

If the LCD companies of the world can work within a standard for mounting, (VESA) then why can’t the Credit Card Reader manufacturers? I’ve got to be far from the only person who thinks this sucks. Unless you make a living making 100’s of different mounting stands for them I guess…

Ingenico, PAX Technology, Inc. (North America), Verifone etc… You know who you are.

Here is edited version of Cardholder Activated Terminal FAQ

There are two primary classifications of Point of Sale Terminal Types: Attended and Unattended Payment Terminals are classified into two major types, depending on the situation:

1. Attended Terminals
  1. A POS Transaction occurring at an attended POS Terminal is a face-to-face Transaction, since a Sales Person or Representative is present at the time of the Transaction.
2. Unattended Terminals or Cardholder Activated Terminals (CATs)
  1. A POS Transaction occurring at an unattended POS Terminal is a non-face-to-face Transaction, as NO Sales Person or Representative is present at the time of the Transaction. Examples of unattended POS Terminals include ticket dispensing machines, vending machines, automated fuel dispensers, toll booths, kiosks, and parking meters.

Resource: we highly recommend UCP Inc. and Rob Chilcoat for detailed questions on CAT terminals. For actual terminals we recommend Ingenico Self Service

Saying Yes to a McDonalds, Costco or a Home Depot

Quasi Classification of “Semi-Attended” — This is a gray area coined by processors in order to permit use of Attended Terminals on self-service kiosks. in an Unattended Mode. Typically this is seen by large corporations Solution like this have become common in big box retail stores (e.g. Home Depot, Costco). where They wish to use the same terminals throughout their organization as this reduces their upfront costs and long term support costs. business case with the same liability. The processors will “concede” to the use but only with If a kiosk maker goes this direction, it is important to be aware that merchant accounts may come with additional stipulations for use. Example stipulations might be that the kiosk is only accessible during business hours and is under the supervision of an agent of the merchant (store employee). Preconditions for obtaining such a classification by the processor is directly related to leverage the corporation may exert. Small business is not in that position.

As far as the PCISSC is concerned there is no such thing as “semi-attended.” A device is either an attended device (used with the assistance and under the supervision of a representative of the merchant) or is unattended (cardholder activated and used for self-service). Another big determining factor when deciding to go to market with a semi-attended solution is the physical environment the kiosk will be placed. We’ve had major transportation system companies ask to use an attended device on a train platform or another client that wanted to use it for ferry ticketing at a marina. An attended device is not designed to stand up to temperature variations, humidity, direct sunlight, or the abuse and traffic it will experience in these use cases. Other things like wet fingers at a water park and wet credit cards will also make using an attended device cost much more money in the long run due to frequent field support and repair issues. This gray area of “Semi attended” was coined by the processors who allow some merchants to use attended terminals in unattended situations which always comes with stipulations like the terminal must be only accessible during business hours and up to X number of self-checkout stations have to be supervised by an attendant, or you can’t sell alcohol or cigarettes at them. The alcohol stipulation was changed a while back by having the attendant at the self-checkout area check the ID and either swipe a badge or enter a code to allow for the sale of age-restricted products. If a kiosk solution provider wants to do everything aboveboard from a PCISSC perspective they should use unattended devices designed for self-service environments and have enhanced physical and tamper detection features. It is important that all merchants routinely check their terminals for signs of tampering and merchants operating self-service kiosks need to be extra vigilant. so that no exceptions ever have to be sought to operate in this semi-attended gray area with their prospective client’s processor. Use case and terminal model to be used are made part of a merchant account application and it is always possible an underwriter who reviews that application for risk might flag an attended device used at a kiosk as unacceptable. Also, when a kiosk solution uses a device that has gone through all the required testing to be considered and certified as a true unattended solution there are other added cost savings benefits when the merchant account is setup properly. it comes to an EMV certification, there is a whole host of tests scrips the person doing the certification has to run through to get an L3 EMV cert with a processor, and when the use case is for self-service there are additional tests cases that have to be run for the L3 EMV cert to cover unattended. It’s all-around best practice to use a device designed for self-service basically.

Credit Card Reader Unattended Resources

We have the Mastercard quick guide to cardholder activated terminals pdf available (circa 2017)
Olea Kiosks
Ingenico Payment
REDYREF Kiosks
Datacap Systems, Inc.
UCP Unattended Payments

Cardholder Activated Terminal FAQ

There are two primary classifications of Point of Sale Terminal Types: Attended and Unattended Payment Terminals are classified into two major types, depending on the situation:

Attended Terminals
1. A POS Transaction occurring at an attended POS Terminal is a face-to-face Transaction, since a Sales Person or Representative is present at the time of the Transaction.
Unattended Terminals or Cardholder Activated Terminals (CATs)
1. A POS Transaction occurring at an unattended POS Terminal is a non-face-to-face Transaction, as NO Sales Person or Representative is present at the time of the Transaction. Examples of unattended POS Terminals include ticket dispensing machines, vending machines, automated fuel dispensers, toll booths, kiosks, and parking meters.

Resource: we highly recommend UCP Inc. and Rob Chilcoat for detailed questions on CAT terminals. For actual terminals we recommend Ingenico Self Service

Saying Yes to a McDonalds, Costco or a Home Depot

Quasi Classification of “Semi-Attended” — This is a gray area coined by processors in order to permit use of Attended Terminals in an Unattended Mode. Typically this is seen by large corporations (e.g. Home Depot, Costco) where they wish to use the same terminals throughout the business case with the same liability. The processors will “concede” to the use but only with additional stipulations for use. Preconditions for obtaining such a classification by the processor is directly related to leverage the corporation may exert. Small business is not in that position.

CAT Definitions

The generally used CAT definitions for Mastercard for example are for CAT1, CAT2, CAT3, CAT4, CAT6, CAT7 and CAT9

Post Views: 60