Point of Interaction (POI)
PCIComplianceHubLast updated
The device at which a payment card, or a phone or wearable acting as one, is read: a terminal, a PIN pad, an ATM card reader, a fuel dispenser's reader. It is the first place account data exists in a card-present transaction. Requirement 9.5.1 requires POI devices that read cards by physical interaction to be inventoried, inspected for tampering and substitution, and handled by trained personnel, and the Council's PTS programme certifies the devices themselves.
Applies to. Under 9.5.1 the protections fall on POI devices that capture payment card data through direct physical interaction with the payment card form factor, which puts them on any merchant or service provider running card-present terminals. Three sub-requirements carry the detail: 9.5.1.1, an up-to-date device list with make, model, location and serial number or other unique identifier; 9.5.1.2, periodic inspection of device surfaces for tampering and unauthorised substitution; and 9.5.1.3, training for personnel in POI environments to check the identity of anyone claiming to be repair or maintenance staff, to follow verification procedures before a device is installed, replaced or returned, and to report suspicious behaviour. Separately, 3.6.1.2 names a PTS-approved POI device as one of the secure cryptographic devices in which keys protecting stored account data may be held.
Example. A cafe chain keeps a register of every PIN pad across its stores, recording make, model, store and counter position, and serial number. The opening supervisor checks each device's surfaces and cable against the register before trading, and staff are trained to ask anyone who turns up to swap or service a terminal for identification and to phone head office before letting them touch it.
Limits. A POI is not the whole POS: the till, the back-office server and the software around the reader are POS components, but only the device that physically reads the card is the POI that 9.5.1 lists and inspects. 9.5.1 addresses tampering and unauthorised substitution of the deployed device; it does not certify the device's design, which is the job of the PTS programme, and a PTS approval does not by itself satisfy the list, inspection and training in 9.5.1.1 to 9.5.1.3. The requirement is written for devices that capture card data through direct physical interaction with the payment card form factor, so a keyboard used to key in a card number read out over the phone does not meet that description.