The opening checklist covers the cash drawer, the lights, and the coffee. Does anyone check that the card reader is still the same device, with the same cables and casing, that the shop is supposed to have?
For retailers, cafes, and service businesses taking payments in person, that is a useful question to settle before seasonal staffing gets busy. This is an evergreen security check, not a newly announced rule or a report of a breach at the business pictured.
Start with a reference, not a guess
The PCI Security Standards Council's small-business inspection guidance recommends keeping a terminal list and photographs showing each device's front, back, cords, and connections. Look for broken seals, unfamiliar attachments, or changed cabling. Record who inspected which terminal, when, and what they found.
Its advice also covers service visits: only expected, authorized repair personnel should work on terminals. If something looks suspicious, contact the terminal supplier or merchant bank immediately.
Our practical suggestion: put the reference photos and the supplier's verified support number in the same staff-accessible folder. A new shift supervisor should not have to remember what the reader looked like last month or search for a phone number while customers wait.
A tether is not the whole control
The Council's current explanation of PCI DSS Requirement 9.5 identifies three elements: an up-to-date device list, periodic inspections for tampering or unauthorized replacement, and staff training. It does not require devices to be physically attached to a counter.
The FAQ applies that requirement to deployed card-present payment devices. It distinguishes ordinary merchant-owned smartphones and tablets, for which these measures are recommended practices rather than requirements under that provision. Ask your payment provider which procedures apply to your setup.
Give staff a stop-and-call rule
Adyen's terminal inspection instructions offer a concrete vendor example. They recommend weekly checks and direct users to stop using a terminal displaying a tamper warning and contact support immediately. Checks include unexpected attachments at the reader, screen, keypad, or ports, as well as damage and missing screws. Adyen also says to verify maintenance personnel before granting access.
That weekly recommendation is Adyen's guidance, not a universal schedule for every processor. Follow your own provider's instructions and required inspection frequency.
Your next opening checklist
Here is a simple workflow to adapt:
- Assign ownership. Name the person responsible for inspections and a backup.
- Make the comparison possible. Keep a device register and approved reference photos.
- Record the result. Use a log with date, device, checker, findings, and action taken.
- Plan the interruption. Decide whom staff call and which provider-approved alternative checkout method they can use if a reader must come out of service.
The owner takeaway: A successful transaction is not an inspection. Give staff a known-good reference and authority to stop using a suspicious terminal, rather than leaving them to improvise at the counter.