Unattended payments: PCI and device security risks for parking, fuel, EV charging and kiosks

Parking pay stations, fuel pumps, EV chargers, ticket machines and self-service kiosks all have one thing in common: no employee stands beside the payment terminal. That convenience creates specific security risks. This article looks at the main threats to unattended payments, what PCI standards require, and what operators can do.

Why unattended terminals are attractive targets

An unattended terminal is often outdoors, available around the clock and checked only occasionally. A criminal can spend time at the device without being noticed. The main risks are:

• Skimming: a device that captures card data is attached over or inside the card reader.
• PIN capture: hidden cameras or keypad overlays record PINs.
• Tampering and substitution: the terminal is opened, modified or replaced with a fake.
• Network and software attacks: modern chargers and kiosks are connected computers, often managed remotely, which adds the usual risks of weak passwords, unpatched software and exposed management interfaces.

Skimming remains a real problem

Skimmers on fuel pumps continue to make the news. In February 2026, police in Salina, Kansas, warned the public after a card skimmer was found on a diesel pump, following a report of fraudulent charges on a company card used at the station. In November 2025, police in Louisiana sought a man in connection with a card skimmer placed on a gas pump. These are US cases, but the techniques are not limited by borders, and Canadian operators of pumps, parking and kiosks face the same kinds of devices.

Chip cards, contactless payments and mobile wallets have reduced the value of stolen magnetic stripe data. But where a terminal still accepts fallback transactions or PIN entry, the risk does not disappear.

What PCI standards require

PCI PTS for the device. Payment terminals that accept PIN entry are evaluated under the PCI PIN Transaction Security (PTS) point-of-interaction (POI) standard. Devices are approved against a version of that standard, and approvals expire over time. In September 2025, the Council extended the expiration of PTS POI v5 device approvals from 2026-04-30 to 2027-04-30. The extension applies only to devices already approved under v5, and the Council encourages organizations to engage with their device providers to identify appropriate upgrade paths. If you operate a fleet of unattended terminals, now is the time to check device versions and replacement plans.

PCI DSS for the operator. PCI DSS requirement 9.5.1 requires merchants to protect payment terminals from tampering and unauthorized substitution. This means keeping an up-to-date list of devices, inspecting them periodically and training staff to recognize tampering. Under v4, the frequency of device inspections is set through a targeted risk analysis (requirement 9.5.1.2.1). An unattended pump on a highway has a very different risk profile from a kiosk inside a staffed lobby, and the inspection schedule should reflect that.

The rest of the environment. If the unattended terminal connects to a back-end system, a payment application or a cloud management platform, those systems are likely in scope too. Remote access used to manage devices must meet PCI DSS access and authentication requirements, including multi-factor authentication.

Practical steps for operators

1. Know your fleet. Maintain an inventory with location, make, model, serial number and PTS approval status for every device.
2. Use tamper-evident controls. Security seals, locks and alarms on cabinets make tampering harder and easier to spot.
3. Inspect on a risk-based schedule. Document every inspection. The Council’s skimming prevention best practices include practical guidance on what to look for.
4. Favour encryption at the point of interaction. Solutions that encrypt card data at the reader, such as validated P2PE, reduce exposure in the rest of your network and can simplify your validation.
5. Harden remote management. Change default credentials, apply MFA, restrict management access and keep firmware up to date.
6. Segment the network. Keep terminals and payment systems isolated from public Wi-Fi, building systems and corporate networks.
7. Plan for end of life. Track PTS approval expiry dates and budget for replacements before they become urgent.

A note on debit and Interac

In Canada, many unattended terminals also accept Interac debit, which relies on PIN entry. This can add network-specific security expectations on top of PCI requirements. Operators should confirm with their acquirer which assessments apply to them.

For more on the standards, see our PCI DSS and Interac pages. Ubitrak performs payment card and Interac-related assessments and security testing of connected devices and management platforms. Contact us to review your unattended payment environment.

Sources

• Compass IT Compliance: Maintaining targeted risk analyses for PCI DSS compliance
• PCI SSC bulletin: Extension of expiration of PCI PTS POI v5 devices
• PCI SSC: Skimming Prevention Best Practices for Merchants
• KWCH: Salina police alert public after card skimmer found at gas station pump
• WAFB: Man sought in connection with card skimmer on gas pump