KARACHI:
A largely overlooked form of cybercrime and financial-data theft may be taking place at physical points of sale in Pakistan. At some supermarkets, shopping malls, grocery stores and petrol stations, customers are sometimes asked to process their debit or credit cards through an additional or unexplained private machine before or alongside the regular bank POS terminal. While multiple terminals can have legitimate purposes but any unauthorised device that captures, copies, stores or transmits payment-card information can create a serious cybersecurity threat.
This is not simply a matter of banking or consumer inconvenience. Unauthorised acquisition or copying of electronic financial data can potentially constitute a cybercrime, depending on what information is collected, how it is processed, whether authorisation exists and whether it is subsequently misused.
Internationally, POS-terminal compromise and card skimming are established forms of cyber-enabled financial crime. More importantly, the State Bank of Pakistan has previously warned about the theft of customers’ card data and advised banks to discourage card swiping at merchants’ non-POS terminals.
There is also a separate financial and tax-compliance concern. A card payment does not automatically mean that the corresponding sale has been properly recorded or reported to SRB and FBR. Where required by law, the sale should be invoiced and reflected through the applicable POS or e-invoicing system. Any deliberate concealment of taxable sales would require separate investigation and evidence.
The authorities should therefore examine whether all card-reading devices being used by merchants are authorised, traceable, secure and connected to legitimate payment infrastructure, and whether customer financial data is being collected and processed lawfully.
Financial privacy is a fundamental component of cybersecurity. Regulators, banks and law-enforcement agencies should treat unauthorised payment-data collection as a serious potential cybercrime rather than waiting until consumers suffer financial losses.
Qazi Fahad Ahmed
Karachi
