Financial technology has transformed how we access our money and pay for goods and services. From the first automated teller machines (ATMs) to today’s contactless payment terminals and emerging Mobile Payments on Commercial Off-The-Shelf (MPoC) solutions, each wave of innovation has brought both convenience and security challenges.
In this post, we will trace the evolution of these devices, explain how they work, explore the cybersecurity risks they face, and examine how regulations and standards are shaping their adoption and security posture.
1. A Brief History of ATM and POS Technology
The Birth of the ATM
The first modern automated teller machine - what we now call an ATM, or in Canada ABM (automated banking machine) - traces back to the late 1960s. While prototypes existed earlier (including Luther Simjian’s Bankograph machine in the 1960s), the first widely recognized ATM was installed on 27 June 1967 at a Barclays Bank branch in Enfield, North London. This early device dispensed cash and used paper check vouchers marked with a radioactive tag - quite different from today’s plastic cards and PINs.
Shortly therafter, magnetic stripe cards and PIN authentication - the foundation of modern ATMs - were patented and adopted. James Goodfellow, for instance, patented a system in 1966 that integrated a machine-readable encrypted card and PIN, which influenced future designs. By the late 1960s and early 1970s, ATMs entered the mainstream in the U.S. and other markets, gradually expanding functionality beyond cash dispensing to include balance inquiries, deposits, transfers, and more.
The Evolution of POS Terminals
Point-of-sale (POS) terminals evolved alongside card usage. Early POS systems were simple card readers connected to manual terminals where merchants called to verify card details. Over time, these integrated more sophisticated electronics, eventually becoming dedicated devices that process chip and magnetic stripe cards.
Verifone, one of the oldest brands in the space, began in the early 1980s and quickly dominated the POS market by integrating secure card processing into retail terminals.
By the 2000s, contactless payment technologies about blog/revolutionizing retail a deep dive into the evolution of payment terminals/ such as RFID and NFC became widespread, enabling “tap-to-pay” transactions that significantly improved transaction speed and convenience.
Cardless and Mobile Payment Innovations
The 2010s and 2020s brought mobile wallets (e.g., Apple Pay, Google Pay) and new payments frameworks like Host Card Emulation (HCE), which allow software-based virtual card functions for contactless transactions.
At the same time, small merchants began adopting mobile POS (mPOS) solutions - often smartphone-based - which can accept card payments with minimal hardware. https://www.paymentyearbooks.com/sample-report about sample report
2. Understanding the Different Payment Device Types
For clarity, let us define the key device categories we will discuss:
- ATMs (Automated Teller Machines)
Unattended terminals deployed primarily by banks for cash withdrawals, balance inquiries, deposits, transfers, and other self-service banking functions.
There are card-based ATMs (requiring a physical card) and cardless ATMs, which allow access via mobile apps or digital identifiers (e.g., QR codes, one-time codes tied to an account).
Contact and Contactless POS Terminals
Traditional POS terminals accept a magnetic stripe swiping, contact payments (inserting a chip card) and contactless payments (tapping a card or mobile wallet via NFC/RFID). Contactless has become ubiquitous - by 2022, over 85% of POS terminals in some regions were contactless-enabled.
MPoC (Mobile Payments on COTS) Devices
MPoC is a standard about about us/press releases/pci ssc publishes new standard for mobile payment solutions/ formalized by the PCI Security Standards Council (PCI SSC) that allows merchants to accept card payments (contact and contactless) and PIN entry on commercial off-the-shelf (COTS) devices like smartphones or tablets.
MPoC builds on earlier standards:
- PCI SPoC (Software-based PIN Entry on COTS)
- PCI CPoC (Contactless Payments on COTS)
– bringing both PIN and contactless support on software platforms. cryptomathic.com about blog/mobile point of sale compliance what is it all about
3. How These Devices Work (At a High Level)
ATMs
ATMs connect to the bank’s core systems, authenticate card details and PINs, then authorize transactions. Contactless ATM transactions typically still require PIN validation for security.
POS Systems
POS terminals read card data (chip, magnetic stripe, or contactless), transmit it securely to payment processors and card networks, and complete authorization in near real-time.
Modern terminals use EMV (Europay, Mastercard, Visa) standards for chip-based and contactless transactions. EMV tokens and cryptograms ensure dynamic authentication per transaction.
MPoC / SoftPOS Solutions
SoftPOS applications on smartphones or tablets use secure software stacks to emulate or manage card acceptance. In MPoC, specialized secure elements within the device or SDK handle sensitive payment data and ensure PCI-compliant security requirements.
4. Cybersecurity Challenges Across Devices
Each device category faces unique security risks - some longstanding, others emerging with mobile and contactless innovations.
PCA Cyber Security is a trusted partner about industries/financial services industry page for securing payment endpoints, including ATMs, POS terminals, and MPoC solutions. We provide advanced threat monitoring, compliance consulting, and hardware lifecycle protection to help businesses stay ahead of evolving risks.
Legacy Software and Hardware Vulnerabilities
Many ATMs and POS terminals run outdated operating systems, like unsupported versions of Windows, which can leave them open to malware and remote exploitation. Security analysts have documented ATM malware in the wild attacks for years (e.g., Tyupkin malware about resources/malware analysis/tyupkin atm malware analysis/, selling ATM malware on Darknet about atm malware is being sold on darknet market/81871/).
The slow pace of hardware refresh cycles and patching contributes to continued vulnerability.
Physical and Skimming Attacks
Devices with exposed card readers are at risk of skimming hardware overlays that steal magnetic stripe or EMV chip data and PINs. Although EMV chips make cloning much harder than magnetic stripes, attackers still use physical tampering and ATM skimmers/shimmers to capture data.
POS terminals and unattended ATMs alike are targets for such tampering.
Contactless and NFC Risks
Contactless and NFC technologies are convenient, but wireless communication introduces its own risks - such as interception or relay attacks - especially if systems are not properly configured about the rise of contactless payments transforming the way we transact/ to enforce short range and cryptographic protections.
Emerging academic research about abs/2504 also shows nuanced vulnerabilities in EMV contactless protocols if implementation flaws exist, potentially allowing unauthorized transactions.
Software-based Payment Solutions (MPoC / SoftPOS)
Software payment stacks significantly expand the attack surface. When payment acceptance is implemented on general-purpose devices (smartphones, tablets), there is risk from:
- Malicious apps or mobile malware
- OS-level vulnerabilities that may expose memory or secure elements
- Insecure integration with other apps or device sensors
Careful implementation of MPoC security baselines and ongoing threat monitoring is vital.
5. Regulatory and Standards Landscape
Payment industry security is governed less by traditional government regulation and more by contractual and industry standards that devices and service providers must meet.
PCI Security Standards
The Payment Card Industry Security Standards Council (PCI SSC) maintains a suite of security standards about standards/ for payment systems, including:
- PCI DSS (Data Security Standard) about standards/pci dss/ - baseline requirements for entities handling card data.
- PCI PTS POI (PIN Transaction Security for Points of Interaction) about standards/pts point of interaction poi/ - defines physical and logical security requirements for PIN entry devices and payment terminals.
- PCI MPoC about standards/mobile payments on cots mpoc/, SPoC about standards/software based pin entry on cots spoc/, CPoC about standards/contactless payments on cots cpoc/ - standards specifically for mobile and software-based acceptance solutions.
These are only some of the most important standards of the PCI Security Standards Ecosystem. Partnering with PCA Cyber Security supports compliance with the related PCI standards, reducing risk and maintaining uninterrupted payment processing.
While PCI standards are technically not laws, card networks typically require compliance as a condition for processing transactions. Non-compliance can result in fines, account suspension, and higher liability for fraud.
Academic research about abs/2512 shows that enforcement and compliance with PCI DSS vary widely, and weak enforcement models can undermine security outcomes.
EMVCo Standards
EMVCo about www.emvco.com defines the technical standards for chip and contactless payment interoperability. EMV adoption significantly reduced fraud on in-person chip transactions compared to magnetic stripes - but contactless EMV involves complex cryptographic protocols that demand correct implementation.
Local and Government Regulations
Countries and regions often layer their own rules on top of payment industry standards. For example:
- ATM safety acts about blog/new york atm safety act is your bank in compliance/ in certain U.S. states have imposed requirements on surveillance and physical protections.
In the European Union, directives like PSD2 affect authentication requirements and risk profiles for payments more broadly, though not specifically POS device standards.
6. The Future: Why Physical Devices Still Matter
The rise of digital wallets and mobile payment solutions has fueled speculation that physical devices like ATMs and terminals might disappear. But that is unlikely any time soon.
Cash Usage Persists
Despite digital growth, cash remains a resilient payment method in many markets - especially for low-value transactions, tourism, and fallback when digital systems fail.
ATMs still provide essential liquidity infrastructure, including in remote or underserved regions where digital acceptance is limited.
Contactless Ubiquity
Contactless payments have become a baseline expectation. Consumers value speed and convenience. Many POS terminals today support both contact and contactless payments seamlessly.
MPoC and SoftPOS Adoption Accelerates
MPoC brings mobile devices into the payments ecosystem about about us/press releases/pci ssc publishes new standard for mobile payment solutions/ more deeply by enabling secure payment acceptance without dedicated hardware. This is particularly attractive to small and medium merchants seeking lower infrastructure costs or more flexible solutions.
With projections about sites/default/files/resource document/2024 05/Ingenico SoftPOS WhitePaper US pointing to continued growth in SoftPOS and mobile acceptance markets (e.g., millions of merchants projected to adopt MPoC-style solutions by 2027), this trend is set to reshape how payments are accepted at smaller scales.
However, broader adoption also raises new security considerations.
7. Emerging Security Trends & Best Practices
Secure Software Design for MPoC
Developers must enforce:
- Strong cryptography and secure key management
- Device attestation and continuous monitoring
- Isolation of payment code from other applications
- Compliance with updated PCI MPoC requirements
Together, these practices help reduce risk when using general-purpose devices as payment endpoints.
Hardware Lifecycle Management
For ATMs and traditional terminals:
- Regular firmware and OS patching
- Replacement of legacy hardware where vendor support has expired
- Physical tamper detection and response mechanisms
- Advanced periodical software and hardware security audits
These remain crucial to preventing compromises.
Data Encryption and Tokenization
Using PCI-approved encryption and tokenization schemes - where sensitive card data is replaced by non-sensitive tokens - reduces exposure even if attackers capture data in transit or at rest.
Ongoing Monitoring and Incident Response
Merchants and banks should implement operational controls like real-time monitoring, fraud detection, and incident response plans. This aligns with PCI DSS requirements and improves resilience against evolving threats.
Conclusion
The evolution of payment devices - from early card-based ATMs to contactless terminals and MPoC solutions - reflects both technological innovation and the relentless drive for convenience.
Cybersecurity, however, remains a moving target. Each new form of factor and interaction model introduces modern risks that industry standards and regulations must catch up with. While physical devices are not disappearing, hybrid models like MPoC will increasingly play a significant role in the payment ecosystem.
To navigate this landscape, stakeholders must embrace both technological best practices and rigorous compliance frameworks to balance innovation with trust. Only then can we unlock the full potential of modern payments while safeguarding users and businesses alike.
As payment technologies evolve, working with experts like PCA Cyber Security about industries/financial services industry page helps organizations safeguard their infrastructure, maintain compliance, and build trust. We understand how attackers operate and know that compliance may not be enough. With our highly qualified embedded cybersecurity researchers, we make sure the risks are minimized within your payment ecosystem.