As UK businesses increasingly move toward cashless payments, cybercriminals are targeting point-of-sale (POS) systems. In the first half of 2025 alone, £600 million was stolen through payment-related fraud, a three per cent increase on the same period in 2024.
Managing Director at myPOS.
How POS malware works
POS malware is software specifically designed to steal customer payment information. In many cases, the stolen data is sold to other bad actors, who can exploit it in diverse ways. Attackers do so using a variety of techniques:
Article continues below
- Exploiting vulnerabilities – POS systems run on common operating systems like Windows, Linux, or Android variants. Weaknesses can emerge from outdated software, unpatched third-party components, or poorly secured networks. Attackers may scan for unsecured IP addresses or compromise Wi-Fi connectors to remotely plant malware, steal data, or disrupt operations.
- Physical installation – infected USBs or other media can introduce malware, allowing attackers to monitor, capture, and transmit sensitive data.
- Brute force attacks – automated programs cycle through thousands of username and password combinations to break into systems.
- Compromised credentials – stolen login details from previous breaches, including those of third-party vendors, allow attackers to impersonate legitimate users and move laterally within systems undetected.
- Insider threats – staff can be bribed or misuse their access to tamper with devices or install malware, allowing silent data theft. Once in a POS system, malware collects sensitive data and often transfers it to remote servers, leaving businesses vulnerable to financial loss and reputational damage.
Types of POS malware
Not all POS malware works the same way, each variation operates with its own tactic and target, making each one effective in different situations.
- RAM scrapers – capture unencrypted payment data in memory during processing.
- Network sniffers – intercept and log network traffic to obtain sensitive information, making it a popular reason for concern for those relying on networked transactions.
- Keyloggers – record keystrokes on POS terminals or connected devices to store login credentials and card information.
- File injectors – embeds harmful code directly into genuine POS system files. Once compromised, these modified files act as a gateway for data theft or other malicious actions.
- Backdoor – creates a hidden entry point, giving long-term, undetected access to the system.
Reducing risk: Best practices for UK businesses
Preventing POS malware requires a holistic approach that combines technology, process, and people. Key strategies for businesses include:
- Secure POS network and devices Insecure networks are a common vulnerability that invites POS malware attacks. To ensure protection, prioritize using encrypted connections, which will help secure data in transit. Businesses can rely on secure communication protocols like TLS for this purpose. Always implement software updates and regularly patch for vulnerabilities in POS software and devices.
- Access controls Implementing strict user access policies ensures that only authorized personnel can access sensitive systems. Multi-factor authentication, unique passwords, and role-based access add an extra layer of security for remote access and reduce the risk of insider threats and credential compromise.
- Physical POS security To minimize risks, block access and make it available only to authorized personnel. Ensure consistent monitoring of physical devices and conduct regular inspections for tampering or unauthorized modifications. Don’t forget the importance of securing peripheral devices, like barcode scanners, receipt printers, and other accessories.
- Advanced anti-malware solutions Deploy reliable anti-malware tools and intrusion detection systems (IDS) to identify suspicious activity. Keep software and signature databases updated to detect emerging threats.
- Encrypt sensitive data Protect payment information with PCI-validated point-to-encryption. This also helps businesses comply with Payment Card Industry Data Security Standards (PCI DSS.
- Strengthen vendor and third-party security Check whether third-party partners follow strict security practices and choose wisely before partnering. Most importantly, when starting a partnership with a new vendor, discuss their security obligations and include them in your contracts. This will keep everyone on the same page and will set clear security expectations.
The business imperative
For UK SMEs, the consequences of POS malware attacks extend beyond just financial loss. Breaches can damage customer trust, incur regulatory penalties, and disrupt daily operations.
Proactively implementing security measures is not just a technical necessity but a strategic business decision that safeguards both revenue and reputation.
In a fast-moving payments landscape, businesses that prioritize POS security, integrate staff training, and adopt a proactive, layered security strategy are better positioned to reduce risk and maintain customer confidence.
The goal is not simply compliance, but resilience: ensuring that digital payment systems operate securely, reliably, and without interruption.
We’ve found the best POS system for food trucks.
This article was produced as part of TechRadarPro’s Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:
