Multiple businesses in Toronto’s east end say they are out thousands of dollars after so-called “point of sale”, or POS, scam thefts.
The thefts have prompted the area’s BIA to warn business owners about the vulnerabilities of POS terminals.
Lori Van Soelen, manager of the Beach BIA says she first learned of POS thefts in the area about three weeks ago when a business owner reached out to her.
Van Soelen said the business owner said a customer came in, pretended like the tap function wasn’t working, and told the owner they could return. But the alleged thief never did.
The business owner later realized that her point of sale system had been accessed, and someone had refunded themselves almost $5,000, Van Soelen said.
Van Soelen said up to seven business owners in the Beaches area have reported being victims of these kind of thefts.
She said in some cases, thieves are correctly guessing the password to the POS and refunding themselves money while in other cases, thieves are swapping the point of sale terminal for their own when the business owner isn’t looking.
“My understanding is that every one of those POS terminals come with a default setting,” she said.
“Unless the business owner changes the passcode, they are at risk for someone to know that default, or they haven’t set up the full security on the different settings in it.”
She said it doesn’t seem to be just one person operating the scam, and thinks that multiple people are responsible for the various incidents.
Thefts like these can be devastating for independent business owners, said Van Soelen.
“In this little neighbourhood alone, we have a lot of independent businesses,” she said. “It’s an immediate loss on these revenues. With everything else in our economy, it’s a huge loss for these businesses who don’t have the security of a larger corporate chain behind them.”
Shiro Maruo, co-owner of NaNa Florist near Danforth Avenue and Main Street in the Upper Beaches, said he has been a victim of this type of theft.
Maruo said the theft happened on June 21, when two men who claimed to be interested in purchasing flowers but left without buying anything.
Less than half an hour later, he received an email from the payment processor, Clover, saying the manager’s code on the terminal was changed and a $2,000 refund had been issued.
After multiple calls to Clover, TD Bank and Toronto police, the money was frozen, and remains held.
It hasn’t been released to the alleged thieves’ accounts, but Maruo says the bank is holding the money of all sales done between Friday, June 20 and Monday, June 23. For its part, Clover said it will refund Maruo the $2,000.
Maruo says he believes the men swapped his point of sale machine with another when he wasn’t looking.
Toronto police said the theft of point of sale terminals “is the cause of this scam occurring,” and recommended that business owners keep their terminals out of reach of customers.
Clover told CBC in a statement it is actively working with its clients “to ensure full resolution.”
However, Clover added “business owners have full control over refund permissions—allowing organizations to disable refunds, set limits, and assign employee-level entitlements to staff – ensuring secure and accountable operations.”
It also said it educates business owners on best practices for device security.
One cybersecurity expert agrees that while it is up to businesses to secure their equipment, the onus does fall on POS vendors to deliver a secure device.
WATCH | Break-ins in Toronto’s Roncesvalles neighbourhood have business owners on high alert
Break-ins in Toronto’s Roncesvalles neighbourhood have business owners on high alert
“When they deliver a unit, that unit should be secured,” said Claudiu Popa, who’s spent decades investigating cybercrime and educating the public.
“They should have changed their default passwords and they should have disabled their refund functionality. Then you teach the merchant to enable it whenever they want it.”
He said because the units are often insecure, they’ve become easy targets for thieves.
“Criminals used to satisfy themselves with doing this once in a blue moon, and now one or a handful of criminals have decided that walking up and down the street and defrauding a whole bunch of business owners at the same time is a lot more profitable,” Popa said.
POS thefts aren’t just occurring in Toronto. They’re becoming common scams across Ontario.
Vincent Kang is a franchise director at Halibut House Fish and Chips. His family owns the business, which operates 43 stores across the province.
He says four of their locations have been robbed recently, totalling to about $6,000 in stolen money, plus having to replace $3,000 worth of POS terminals.
The first instance happened at their location in Oshawa.
“We put out an email to all our franchisees that evening advising them of the scam and to be aware of it,” he said.
“At which point immediately I had actually received another email from our location in Thornhill that advised me that they too had been robbed. Then over the course of about 48 hours, two more locations were hit.”
His message to other business owners is to be vigilant.
“A lot of these commercial businesses or small businesses are doing their best to survive day-to-day and having something like this occurring to them can be very damaging. Put in those [precautions] and remove those access points.”
