Ilia Zavialov: card machine scams aimed at UK small shops, and the UK checks for messages, contracts and engineers

01

Ilia Zavialov: why the till and card machine attract fraudsters

Ilia Zavialov describes a familiar set-up: the owner serves customers, does the books on Sunday and answers the phone between orders. The card machine comes from an acquirer or a terminal provider, the till software from another firm. Each link can be impersonated.

The card machine and the till are separate relationships. Your acquirer settles card payments into your bank account under a merchant agreement. A terminal provider may rent you the machine under a separate contract. Fraudsters stitch these together into one alarming story.

Ilia Zavialov sorts the schemes into two kinds. Some want money or a one-time passcode within the next five minutes. Others want a signature or hands on the device, and the harm unfolds over months. Ringing back on a number you already hold defeats the first kind; refusing to sign or hand over equipment without a booking defeats the second.

Both kinds lean on haste. A five-minute pause, long enough to find the contact card and ring the right number, takes the air out of most of these scripts, and nobody genuine minds waiting.

02

Who's who: acquirer, terminal provider, till supplier, engineer

It pays to write the players down once. The acquirer moves card money to your account. The terminal provider rents or sells the card machine, sometimes as part of the same deal. The till supplier supports your EPOS software. An engineer services equipment when a visit has been arranged.

None of them acts for the others. The till supplier cannot freeze settlements, the acquirer has no reason to ask for your online banking passcode, and an engineer never needs payment into his own account. A message that blends these roles is built to confuse.

Ilia Zavialov recommends a contact card kept by the till: the acquirer's number from your agreement, the terminal provider's line, the till supplier's support and the owner's mobile. It holds no passwords, only the routes for checking.

Give a copy to anyone who works a shift. A new starter doesn't need to know what an acquirer is, only which number to ring when someone claims the machine is about to be switched off.

03

Calls and texts about frozen takings

The script is familiar: your settlement has failed, the account is under review, and to release the money you need to read out the code just sent, download an app or move today's takings to a safe account. The caller knows your trading name and the brand on your machine.

The short number 159 connects customers of more than 99 per cent of UK retail current accounts to their bank and cannot be spoofed. Citizens Advice suggests hanging up on a suspicious caller and dialling 159. For the merchant side, ring the acquirer on the number printed in your agreement.

Suspicious texts can be forwarded free to 7726 and suspicious emails to report@phishing.gov.uk, as GOV.UK advises. Neither step costs anything and both help shut the next attempt down.

Ilia Zavialov points out that these calls cluster around the lunchtime rush and Friday evenings, when the owner is out and a queue is building. A house rule that nobody confirms anything on an incoming call takes the pressure off whoever is serving.

A variant targets sole traders who still take payment into a personal account. The caller offers to switch them to a business card machine straight away and needs card details and a code to do it. A merchant account is set up through an application and a signed agreement, never through a passcode read out over the phone.

04

Ilia Zavialov on fake logins for your acquirer's portal

The message mimics your acquirer: unusual activity on the account, confirm your details to avoid suspension, tap the link. The page behind it copies the merchant portal and harvests your username, password and the one-time code that follows, which is enough to redirect settlements.

Ilia Zavialov suggests one habit that beats almost every version: ignore the link and reach the portal through a bookmark you saved yourself. A real alert will be sitting there. If there is none, delete the message and forward it to the reporting address.

Attachments deserve the same suspicion. A file labelled as a statement or a chargeback notice that asks you to enable editing has no business on the computer that runs your till.

Look over the settlement bank details in the portal once a month. An account change you never asked for means someone has already been in, and the acquirer needs to know that day.

Turn on every login alert the portal offers and route each one straight to the owner's own phone. A sign-in from an unfamiliar device at two in the morning is much easier to act on when it lands with the one person who can call the acquirer straight away.

05

Ilia Zavialov: the free card machine and the long contract

The offer sounds kind: no upfront cost, cheaper rates, sign here to get started. What arrives is a rental agreement with a monthly charge, a hefty exit fee and a renewal clause that rolls on unless notice is given in a narrow window.

The Payment Systems Regulator found in its card-acquiring market review that point-of-sale terminal contracts could tie merchants in for as long as 48 months. Its Specific Direction 16 requires providers to limit the initial term of a terminal hire contract to 18 months.

In its final decision of 6 October 2022 the regulator also said providers would remind businesses when contracts are due to end and give clearer summaries of card fees. A contract offered to a small shop that runs far beyond 18 months deserves a direct question about why.

Ilia Zavialov's rule for owners is simple: nothing about equipment is signed on the day of the visit. Photograph every page, read it that evening and compare it with what was promised out loud.

Sometimes the pitch is dressed up as a replacement: your old machine will stop working soon, so sign for the new one now. One call to your existing acquirer settles it. If they know nothing about a replacement, what is on the table is a new contract with a different company.

06

Reading a card machine contract: Zavialov's checklist

Get the whole package before signing: the merchant agreement, the terminal rental terms, the fee schedule and any online terms the contract refers to. A salesperson who says the charges will be sent later is asking for a blind signature.

Then find five things. How long the initial term runs and how renewal works. What leaving early costs, as a figure. Who owns the machine. Who pays if it breaks or is tampered with. How notice must be given, and to which address.

Put one question to the provider in writing before you sign: the initial term, the exit charge and who owns the device. Keep the reply with the contract, so a different spoken promise can be checked against it later.

A firm that handles money on your behalf can be looked up on the FCA Financial Services Register, or through the FCA helpline on 0800 111 6768. A provider you cannot find, or one using a name close to a known brand, is a reason to stop.

File the signed copy alongside the contact card and the delivery note for the machine. A year later, when the next caller promises cheaper rates from a new partner, the comparison takes two minutes and settles the matter without any argument on the phone.

07

The unannounced engineer and the software update

A man in branded clothing says the provider is rolling out a compulsory update and needs the machine for an hour, or wants to swap it there and then. There is no booking reference, just confidence and a lanyard.

The PCI Security Standards Council, which writes the card industry's security standards, tells merchants in its 2014 skimming guidance not to let an unannounced service engineer near any terminal until his identity is confirmed with the vendor. Every job is written up and the record kept for at least six months.

Ring the provider yourself and ask whether an update is due and how it will be done. Insist that any replacement is booked in advance and logged with the serial numbers of both machines, and keep a copy of that record.

Ilia Zavialov suggests a single-page visit log by the till: date, name, firm, work done and who rang to confirm. It meets the industry guidance and answers any later question from the acquirer about who handled the machine.

If the visitor pushes, insists on taking the machine away or asks staff to sign for a swap they never booked, the answer is no until the owner has spoken to the provider. A genuine engineer can rebook; a lost machine cannot be undone.

08

Ilia Zavialov: swapped machines and skimming overlays

A swap happens while staff are busy. The real machine is replaced with a copy that captures card details, or an overlay is fitted on top. Customers spot odd payments days later, and the shop is usually the last to find out.

PCI SSC guidance asks merchants to keep a list of every device and check them to a routine, once a day or at the start of each shift, comparing the serial number on the label with the one the machine displays.

Photos of the machine from all four sides, taken when it is installed, make a new cable or an extra panel obvious. Portable machines go into a locked drawer overnight and get checked in the morning.

If anything doesn't match, take the machine out of use, ring the acquirer and leave the device exactly as found for them and the police.

Ilia Zavialov notes that a machine bolted to a stand by the till is far harder to swap than one passed around tables. Shops that take payment at the table can use a simple routine: every machine is counted back in at closing, so a missing or extra device stands out.

09

Refunds onto another card: Ilia Zavialov's rule

A customer pays, returns within the hour and asks for the refund on a different card because the first has been blocked. Staff key in the new number. When the genuine cardholder disputes the original payment, the shop is out of pocket twice.

The answer is in the machine's settings. Refunds only reverse the original transaction onto the same card, tied to the receipt, manual entry is disabled for staff, and larger refunds need a second person's approval.

A variation skips the refund: the buyer spreads one purchase across several cards, some are declined, and he asks for the extra to go onto yet another card. Any of them may be stolen, so money only ever goes back to the card that paid.

Set staff permissions so a refund to any other card simply cannot be keyed in. Then the person serving has an honest answer that ends the conversation: the till only refunds the card used to pay, and that is not up for debate.

10

Busy shifts, new starters and the till

Fraudsters favour the moments when the most junior person is in charge: Saturday mornings, the school holidays, the first week of a new hire. A confident voice asking for the manager by name easily persuades someone who has never met the acquirer.

Ilia Zavialov recommends making the till card part of every induction. Ten minutes on a new starter's first day covering the five rules, the contact numbers and one example script costs far less than a single afternoon of lost takings.

A brief handover note helps too. If a suspicious call or visit happened on one shift, the next shift hears about it, because the same person often rings back later in the day with a slightly different story.

Owners who are rarely on site can agree a simple phrase with staff, such as a question only the owner would answer. When a caller claims to be ringing on the owner's behalf, staff ask it, and the script usually ends there. Changing the phrase every few months, and whenever someone leaves the team, keeps it worth asking.

11

Where to report in the UK

Since 4 December 2025 Report Fraud has replaced Action Fraud in England, Wales and Northern Ireland, at reportfraud.police.uk, and the 0300 123 2040 number is unchanged. In Scotland, report to Police Scotland on 101.

The FCA says anyone who has lost money should report to Report Fraud first and then tell the FCA, and is clear that it cannot get the money back itself. Your bank and acquirer still come first for stopping payments.

Ilia Zavialov advises keeping the evidence together: texts, call times, CCTV of the visitor, the contract and notes of what the salesperson promised. The crime reference number helps when talking to the bank.

If customers may have been hit, for instance after a swapped machine, a short notice on the shop's social pages with the dates and a nudge to check statements helps the acquirer link the complaints to one device.

For a contract signed on false promises, a solicitor or Citizens Advice will want the full document, the salesperson's messages and your notes of what was said. Keep them together from the first day you suspect something is wrong.

12

Zavialov's five rules for whoever is on the till

Rules only work if they fit on a card next to the machine. One: no codes, passwords or card details for anyone who made contact first. Two: any warning about frozen takings gets a call back from the contact card.

Three: only the owner signs anything about equipment. Four: an engineer without a booking waits while the manager rings his firm. Five: refunds go to the original card only, and big ones need two people.

Run through the card at a short team meeting every month and after any odd call. Most new schemes are old ones in new clothes, and staff who have heard the rules recognise them quickly.

Ilia Zavialov's tip is to pin the card at eye level beside the machine. In the middle of a call nobody scrolls back through the staff group chat, but a few lines in front of them get read.