AI-assisted impersonation is now the common entry point
Visa's public threat reporting describes scams that increasingly use generative tools to make impersonation cheap, fast and grammatically clean. For a small business that usually looks ordinary: an email that matches your vendor's template, a text that uses your manager's first name, or a phone call that references a real invoice number.
The defense is procedural rather than technical. If a request involves money movement, banking details, payroll, or account access, it should be verified through a channel the requester did not choose — a known phone number, an in-person confirmation, or a second approver. Treat urgency itself as a warning sign; legitimate vendors accept a callback.
Verify out of band
Call the number you already have on file, not the number in the message. Voice and email can both be imitated convincingly.
Name your approvers
Write down who is allowed to change bank details or issue large refunds, and require a second person for those actions.
Slow the exception path
Most losses happen through the shortcut people take when they feel rushed. A 10-minute verification rule removes it.
Do not ignore login and new-device warnings
Processor portals, POS back offices, banking apps and email accounts all send alerts for new sign-ins, new devices, password resets and changed contact details. Those notices are frequently the earliest signal of an account takeover attempt in progress, and they are also the notices most often deleted unread.
Assign one person to receive and review security alerts for every payments-related account, and make sure the address and phone number on file are current. If a reset was not requested, treat it as an incident and change the password immediately from a known-good device.
Never share a one-time code — with anyone
One-time passcodes exist to prove that the person holding the account is also holding the phone. Handing that code to a caller defeats it entirely. No processor, bank, POS vendor or provider needs a merchant to read back a code, and BSV Solution will never ask for one.
Say this plainly to staff, because attackers rely on employees being polite and helpful. A code request from anyone claiming to be support should end the call and start a callback to the number printed on your statement or terminal paperwork.
Card testing and refund abuse are automated volume games
Card testing is when someone runs many small authorizations to find out which stolen card numbers still work. Online checkout pages, virtual terminals and key-entered environments see it most. Warning signs include bursts of low-value attempts, repeated declines from one address or device, and many different cards sharing an email pattern.
Refund and return abuse is the mirror image: valid-looking refunds pushed through weak process. Common variants include refunds issued to a card other than the one used for the sale, refunds without a matching receipt, and voids created after a shift closes.
Rate-limit online attempts
Ask your gateway provider what velocity rules, CAPTCHA and address verification options are available for your setup.
Refund to the original card only
Make it a rule with no exceptions, and require a manager code for any refund above a threshold you set.
Reconcile refunds daily
A short daily review of refunds and voids by employee catches patterns long before a monthly statement does.
Prevent account takeover before it starts
Account takeover is attractive because one compromised login can reach settlement details, user management and reporting at once. Visa's guidance on fraud management points to layered controls rather than any single tool: strong authentication, monitoring, and limits on what a compromised session can actually do.
For a small merchant, layering is realistic: unique passwords in a password manager, multi-factor authentication wherever the portal offers it, no shared administrator logins, and prompt removal of users who leave.
One login per person
Shared accounts make it impossible to tell who issued a refund or changed a setting.
Turn on multi-factor authentication
Enable it on email first — email is the reset path for everything else.
Remove access on the last day
Offboarding should include POS users, portal logins, email and any delivery or ordering dashboards.
Employee verification and least-privilege POS access
Most POS platforms allow granular roles, but many businesses run every employee as a manager because it is faster to set up. Least privilege means each role can do its job and nothing more: cashiers ring sales, supervisors approve discounts, and only owners or trusted managers can change tax settings, edit items, void closed transactions or export data.
Pair roles with identity. Employees should clock in with their own PIN or badge, and PINs should not be reused or written near the register. When a role change happens, update permissions the same day.
Audit roles quarterly
Print the user list and confirm every account still belongs to a current employee with the right permissions.
Require manager approval for exceptions
Discounts, price overrides, no-sales and refunds are the four actions worth gating.
Keep the audit trail on
Reports that tie actions to users are what let you resolve a discrepancy without guessing.
Terminal hygiene and updates
Physical devices still matter. Tampering and swap attacks depend on nobody looking closely, so build a short daily habit: confirm serial numbers match your records, check for loose panels, added cables, unfamiliar overlays or unexpected attachments, and keep terminals in view during business hours.
Keep software current as well. Apply POS and terminal updates when they are released, retire devices your provider no longer supports, and use a separate, password-protected network for payment devices rather than the guest Wi-Fi customers use.
Log your serial numbers
A photo and a written list make an unauthorized swap obvious.
Control who services devices
Verify any technician visit with your provider before granting access to hardware.
Segment the network
Payment devices should not share a network with guest access or personal devices.
Escalation checklist when something looks wrong
Speed matters more than certainty. Acting on a suspicion costs a few minutes; waiting for proof can cost a settlement. Post this sequence where your staff can see it and make sure at least two people know how to execute it.
1. Stop the activity
Pause the affected terminal, checkout page or user account rather than continuing to process while you investigate.
2. Preserve evidence
Save transaction IDs, timestamps, screenshots, emails and receipts before anything is cleared or reprinted.
3. Change credentials
Reset passwords for the affected accounts from a device you trust, and revoke sessions if the portal supports it.
4. Notify your provider and bank
Report suspected fraud to your processor, your acquiring support line and your bank the same day.
5. Document and debrief
Write down what happened and which control failed, then fix that control. Report the incident to the FTC and local law enforcement where appropriate.
Terminals and POS systems BSV installs
BSV Solution works with several manufacturers, so the right device depends on how you take payments — countertop, handheld, mobile or customer-facing. Availability varies by business profile and is subject to underwriting approval.
Frequently asked questions
Is card-present fraud still a concern in 2026?
Yes, but the pattern has shifted. Chip and contactless acceptance reduced counterfeit card use at the counter, so attackers concentrate on remote channels, social engineering and account access. Terminal tampering remains worth checking daily.
Would my processor ever ask for a one-time code?
No. Legitimate support does not need a one-time passcode read back to them, and BSV Solution will never ask for one. Treat any such request as fraud, end the interaction, and call back using the number on your statement.
How do I tell card testing from normal traffic?
Look for clusters of very small authorizations, high decline rates from a single device or address, and many distinct card numbers within a short window. Your gateway may offer velocity limits and address verification to slow it down.
What is least-privilege POS access?
It means each employee's login can perform only the tasks their role requires. Cashiers ring sales; managers handle refunds, discounts and settings. It limits damage from both errors and compromised accounts.
Can BSV Solution help review my current setup?
Yes. A specialist can review how you accept payments today, including user roles, refund handling and device inventory. Eligibility and processor selection are reviewed individually, subject to underwriting approval.
Sources & further reading
Talk it through with a specialist
Not sure whether your current setup is exposing you to unnecessary risk or cost? Request a free statement analysis from BSV Solution. Eligibility and processor selection are reviewed individually, subject to underwriting approval.