Ilia Zavialov: card terminal scams aimed at small businesses, and how to check the call, the contract and the technician

01

Ilia Zavialov: why the small business checkout is a target

Ilia Zavialov works with businesses where the card reader sits next to the espresso machine and the person at the counter changes every shift. There is no IT department and the bookkeeper comes in once a week. Whoever is holding the phone makes the call, and scammers know it.

The register and the terminal look like one device, yet they involve different parties. Your POS software vendor keeps the register running. Your processor, or merchant services provider, settles card payments under a contract. A sales agent may sit between you and that processor. Scammers blur these roles on purpose.

The FTC's guide for small businesses describes callers who pose as a known company or a government agency, threaten to suspend a license or demand an updated registration, and push for payment by wire, cryptocurrency or gift cards. The FTC asks businesses to report these at ReportFraud.ftc.gov.

Ilia Zavialov splits the patterns into two groups. In the first, someone wants money or a code right now. In the second, someone wants a signature or physical access, and the damage lasts for months. Calling back on a number you already have stops the first group. A rule of no signing and no access without an appointment stops the second.

02

Who is who: processor, sales agent, POS vendor, technician

A short map of the players saves a lot of confusion. The processor moves card money into your bank account. An independent sales agent may sign you up with that processor and earn a cut. The POS vendor supports the register software. A service technician fixes or swaps hardware when you or the vendor book a visit.

None of them speaks for the others. Your POS vendor cannot freeze card deposits. Your processor does not need your online banking code to fix a terminal. A technician does not take payment to a personal account. When a message mixes these roles, it was written by someone who hopes you do not know the difference.

Ilia Zavialov suggests a one-page contact card by the register: the processor's number from your agreement, the POS vendor's support line, the technician's company and the owner's cell. No passwords and no codes, just the four ways to check.

Hand the same card to whoever does your books. Scammers write to bookkeepers too, posing as a client or a provider, and ask them to change payout details or download a statement through a link.

03

Ilia Zavialov on fake processor calls about held deposits

The caller says your batch did not settle, deposits are on hold, and the fix takes two minutes: read back the code we just texted, install this app, or move today's sales to a secure account. He knows your business name and the brand of your terminal, because both are printed on every receipt.

The FTC's 2018 business blog on card processing deals noted that some scammers pretended to be the business's current card processor, and owners signed new contracts believing they were only updating paperwork. The voice on the phone is often the first step toward a new contract.

The check takes one minute. Hang up and call the processor at the number in your merchant agreement or on its official website, typed in by hand. If something is really wrong with your account, the rep you reach will see it.

Ilia Zavialov notes that these calls tend to land at the lunch rush or late on a Friday, when the owner is away and a line of customers pushes the clerk to say yes. A rule that nobody confirms anything on an incoming call takes that pressure off the clerk.

Some versions target owners who still take payments to a personal card. The caller offers to upgrade them to a business terminal on the spot and asks for card details and a code to do it. Merchant accounts are opened through an application and an agreement, never through a code read out on the phone.

04

Ilia Zavialov on fake login pages for your merchant portal

The email looks like a routine notice from your processor: unusual activity, verify your account to avoid interruption, click here. The link opens a copy of the merchant portal that collects your username, password and the code that follows. With those, someone can change where your deposits go.

Ilia Zavialov's test is simple. Close the email and open the portal from a bookmark you saved yourself. If there is a real alert, it will be waiting inside. If there is nothing, the email was the attack.

The same caution covers attachments. A file called statement or chargeback notice that asks you to enable editing or install a viewer has no place on the computer that runs your register.

Check the payout details in the portal every month. A changed bank account you did not request is the clearest sign that someone has already been inside, and the processor needs to hear about it the same day.

05

Ilia Zavialov: the free terminal and the lease you cannot cancel

The pitch sounds generous: a new terminal at no cost, lower fees than your current processor, sign here, it is just an application. The paper turns out to be a multi-year equipment lease with a monthly payment, an early termination fee and automatic renewal.

The FTC warned in 2018 that businesses could pay thousands of dollars to lease equipment that would have cost a few hundred to buy, that sellers promised the business could cancel any time, and that such leases can make the owner or the person who signed responsible for the debt.

In 2022 the FTC described a payment processor that told small businesses they could cancel with no penalty, while the contract ran three years with a $495 early termination fee and renewed every year without saying so. The company agreed to turn over $4.9 million for refunds.

In February 2025 the FTC reported sending more than $2.6 million to 5,588 small businesses in that case and mailing claim forms to another 16,181 for early termination fees. Ilia Zavialov reads those numbers as a reminder that the spoken promise and the written contract are often two different deals.

06

How to read a merchant agreement before you sign

The FTC's advice is short and worth taping to the register: do not be rushed, search the company's name with words like scam or complaint, get every term in writing before you sign and walk away if you do not, and keep a copy of the entire document, especially when you sign electronically.

Ask for the full package: the agreement, the fee schedule, the equipment lease if there is one, and any terms the contract points to on a website. A rep who says the fee schedule will be emailed later is asking you to sign blind.

Then look for five things: the term and automatic renewal, the early termination fee as a dollar figure, who owns the terminal, who pays when it breaks or is swapped, and exactly how to cancel. If the rep says one thing and the paper says another, the paper wins.

Ilia Zavialov adds one habit: send the processor a written question before signing about the term, the exit fee and who owns the device, and keep the reply with the contract. If the rep promised something different, you now have it in writing.

Ilia Zavialov also looks at who is making the offer. A rep who cannot name the processor behind the deal, hands over a card with no company address and says the price is good only until tonight is selling a signature. A real provider gives you time to read.

07

The surprise technician and the firmware update

Someone in a polo shirt with a badge walks in and says the processor is pushing a mandatory update. Without it, the terminal stops taking cards tonight. It takes ten minutes, and the fee is payable to his own account or in cash.

The PCI Security Standards Council, which sets the industry standard for card data security, gives merchants a plain rule in its 2014 skimming guidance: if a person claiming to be a service engineer arrives unannounced, he gets no access to any terminal until his identity is confirmed with the vendor. All work is recorded in a report kept for at least six months.

Ask the vendor on its own number whether any update is due and how it will be delivered. When hardware really needs replacing, insist the swap is booked in advance and documented with the serial numbers of the old and new device.

Ilia Zavialov suggests a one-page visit log: date, name, company, what was done, and who confirmed the visit by phone. It satisfies the industry guidance and settles any later dispute about who touched the terminal.

08

Ilia Zavialov: terminal swaps and skimming overlays

A swap takes seconds while the clerk is distracted. The working terminal is replaced with a lookalike that records card data, or a thin overlay is fitted over the real one. The owner usually learns about it from the processor after customers report strange charges.

The PCI SSC guidance tells merchants to keep a list of every payment device and inspect each one on a schedule, for example once a day or at the start of each shift. The serial number on the sticker underneath should match the serial number the terminal shows on its screen.

For a small shop that is one line in the opening checklist: device in its usual place, original cable, serial numbers match, seals intact. Photos of the terminal from four sides, taken on the day it was installed, make an extra part easy to spot.

If the numbers do not match, stop using the device, call the processor and keep it as it is. Do not open it yourself, since the processor and the police will want it untouched.

Where the terminal lives matters too. A device fixed to a stand at the register is harder to swap than one that travels around the room. If yours is portable, lock it away at closing and check the serial number again when you open.

09

Refunds to a different card: Ilia Zavialov's rule

A customer pays by card, comes back an hour later, and asks for a refund to another card because the first one was frozen. The clerk keys in the new number and sends the money. Later the real cardholder disputes the original charge, and the business loses twice.

The fix lives in your terminal settings. Refunds go back only by reversing the original transaction to the same card, linked to the receipt. Manual card entry for refunds is switched off for clerks, and large refunds need a second person, the shift lead or the owner by phone.

A related trick skips the refund entirely. The buyer splits a payment across several cards, some get declined, and he asks for the overpaid part to go to yet another card. Any of those cards may be stolen, so the same rule applies: money goes back only to the card that paid.

Ilia Zavialov suggests setting clerk permissions so a refund to an arbitrary card is simply impossible. The clerk can then tell the customer the truth: the system only refunds the card that paid, and there is nothing to argue about.

10

How to check an email, a call or a visitor

An email gets four questions. Does the sender's domain match the one in your agreement? What does it want: a click, an attachment, a payment, a code? Is there a deadline like today by 6 p.m.? Could you settle the matter by logging into your account through your own bookmark?

A call gets a callback on the number you already have. A visitor gets a short wait while the shift lead calls the company that supposedly sent him. A real technician waits calmly. An impostor tends to remember another job across town.

Codes are a separate rule. Nobody on the team reads out a code from a text message or installs remote access software because a caller asked, even if the caller knows yesterday's sales total to the cent.

Contract questions get handled in writing. Send the processor your question about the term, the exit fee and ownership through its official portal or to an address on its website, and file the answer with the agreement. A phone conversation with a rep proves very little later.

11

Ilia Zavialov's five rules for the counter

Checkout scams hit the person at the counter, so the rules are written for that person. Keep them short enough to fit on a card next to the terminal, where they will be read at the moment a call comes in.

One: never share codes, passwords or card numbers with anyone who contacted you. Two: any message about a frozen account or a blocked terminal gets a callback from the contact card. Three: nobody but the owner signs anything about equipment.

Four: a technician without a booked visit waits outside the counter until the shift lead reaches his company. Five: refunds only to the original card, and large ones with a second person.

Go over the five rules at a short team huddle once a month and after any odd call. A new scheme is almost always an old one in a different costume, and a prepared clerk spots it in the first sentence.

12

If money or access is already gone

Call your bank and your processor at the numbers on file: lock online access, stop pending transfers, take a suspicious terminal out of service. If you typed a password into a fake login page, change it from a clean device.

Report the scam to the FTC at ReportFraud.ftc.gov or 1-877-FTC-HELP, and keep the emails, phone numbers, camera footage of the visitor and the account details where the money went. If you signed a lease under false promises, keep the full contract and notes of what the rep said.

Ilia Zavialov recommends a fifteen-minute review with the team afterwards: which step the scheme got through, which rule to add to the card, and who gets called first next time.

If customers were affected, for example after a terminal swap, tell them yourself with a short post giving the dates and a suggestion to check their statements. The processor gets complaints faster and can tie the fraud to a single device.