Ghost Terminal
PCIComplianceHubLast updated
A fraudulent payment terminal or point of sale (POS) device, often designed to resemble a legitimate device, used by criminals to capture cardholder data during transactions.
Applies to. PCI DSS v4.0.1 does not name ghost terminals. Where a fake device is swapped in at a merchant's own counter, Requirement 9 is the nearest control: merchants taking card-present payments must keep a list of their POI devices, inspect them for tampering and unauthorised substitution, and train staff to spot a swapped device. A ghost terminal run by the criminal elsewhere, under a stolen or false merchant identity, is a fraud matter for the acquirer and the payment brands rather than a PCI DSS control.
Related. Point of Interaction (POI), Card Skimmer, Skimming, Card-Present Transaction, Point of Sale (POS)
Sources. PCI DSS v4.0.1 (June 2024)