Your POS holds two things worth stealing: your customers' card data and your own cash. They are stolen by different people, in different ways, and almost every restaurant defends against the first and ignores the second. This topic covers both, in the order of how likely they are to happen to you.
🎭 Two risks, not one
| From outside | From inside | |
| Who | Someone who never enters the building | Someone who has a login and a schedule |
| What they take | Card data, in volume | Cash, food, or a discount that goes to a friend |
| How | An unpatched system, a weak password, an open network | Voids after payment, comps, unlogged refunds, no-sale drawer opens |
| How likely | Rare, and expensive when it happens | Common, and it drips |
| What stops it | Updates, network hygiene, letting the processor hold the data | Individual logins, permission limits, reading the exception report |
Both defenses are cheap. Neither is automatic.
🔐 The outside risk, in plain terms
The good news is that the industry moved the hard part away from you. Modern card readers encrypt the card at the moment it is dipped or tapped, so the number never exists in readable form inside your POS. Your job is to not undo that:
- Never write a card number down. Not on a notepad, not in an order note, not in a text message. If you take phone orders, use whatever your system provides for that, and shred anything on paper the same day.
- Install the updates. The single most common way a small business is breached is a system that has not been patched. Schedule it — after close, once a month — rather than clicking "remind me later" for a year.
- Separate the networks. Guest Wi-Fi and the POS must not be the same network. Ask your installer to confirm this in writing; it is often left as it came out of the box.
- Change the default passwords. On the router, on the terminals, on the back-office login. Default credentials for common equipment are published openly.
- Turn on two-factor on the back-office and admin accounts. Not on the floor terminals, where it would make service impossible — on the accounts that can change prices and see reports.
- Ask your vendor who is responsible for PCI compliance and what they do for you. There is a questionnaire; your processor will tell you which one applies. It is administrative work, and skipping it can carry fees.
👁️ The inside risk, and the report that finds it
Internal loss is rarely dramatic. It is small, repeated, and it lives in the transactions that make money disappear after a sale exists. Almost every POS has an exception report that lists exactly those. Learn where yours is and read it weekly:
- Voids after payment. The order was rung, the customer paid cash, the item was voided. This is the classic, and it shows up as a pattern by name.
- Comps and discounts. Not that they happen — that one person's are three times everyone else's.
- No-sale drawer opens. A drawer opening without a transaction has a reason. Sometimes a good one.
- Refunds outside opening hours. Or on a terminal nobody was working.
- Reprinted checks on the same table, repeatedly.
Set the rules before you need them: who may void a rung item, who may comp, and whether a manager code is required. Then apply the same standard to yourself. A report that everyone knows is read changes behavior long before anyone is caught by it.
💾 Backups and the boring paperwork
Two more things, quick to arrange and painful to lack:
- Know where your data lives. Cloud systems back themselves up; a system running on a PC in your office may not. Ask the direct question: "If this machine is stolen tonight, what do I lose?"
- Keep your own export. Monthly, in a format you can open without them. It covers you for a dispute, an audit, and for the day you change vendors.
- Remove logins the day someone leaves. Put it on the offboarding list next to the keys. An active login belonging to a former employee is the most common finding in any small-business review.
- Write down who to call if you suspect a breach: your processor and your POS vendor, with numbers, on paper. Card networks have notification requirements and clocks that start running.