Terminal Security Guide

To maintain a secure payment environment, we recommend all merchants using Surfboard terminals must adhere to these security protocols.

1. Receiving Your Terminal

Every terminal is tracked from our facility to your door. Upon delivery, you must perform the following:

• Verify the Courier: Check that the DHL/UPS tracking number on the package matches the tracking number provided in your Surfboard shipment confirmation email.
• Inspect the Seal: Examine the Tamper-Evident Security Seals on the box. If the seal appears broken, peeled, or shows a "VOID" message, do not open the box. Contact Surfboard Support immediately.
• Log the Arrival: Immediately record the Terminal Serial Number (S/N) and the delivery date in your Device Inventory Log.

2. Secure Installation & Placement

Where you put your terminal matters. A terminal should never be left where it can be tampered with unnoticed.

• Line of Sight: Terminals must be installed in a location where staff can clearly see them at all times during business hours.
• Mounting: We recommend using a fixed stand or tether to prevent "grab-and-go" thefts or unauthorized swaps.
• Semi-Unattended Requirements:
  • If a terminal is placed in a "semi-unattended" area (e.g., a kiosk or a far end of a counter), it must be under constant video surveillance (CCTV).
  • In the event of an alarm or suspicious activity, staff must be able to reach the device within 60 seconds to investigate.

3. Daily Hardware Inspections

You are the first line of defense against skimming. Once a day, perform a 10-second physical check:

• Check for Overlays: Feel around the card slot and keypad. Ensure there are no plastic "skimmers" glued on top.
• Inspect the Casing: Look for new drill holes, strange wires, or broken plastic seams.
• Check the Serial Number: Ensure the S/N on the back of the device matches the S/N assigned to your location in your records.

4. Guarding Against "Imposter" Technicians

Important: Surfboard operates a 100% cloud-based support model.

• No On-Site Visits: We will never send a technician to your place of business to repair or "update" a terminal.
• Unauthorized Access: If an individual claims to be from "Surfboard Support" or "Payment Maintenance" without a prior official appointment or ticket that you initiated, do not grant them access to the device.

5. Safe Returns (Outbound Shipments)

If a terminal is faulty and needs to be returned:

• Official Labels Only: Only hand over the terminal to a courier if you have a pre-printed return label provided by Surfboard Support.
• Verification: Ensure the courier's reference number matches your support ticket.
• De-register the Device: While P2PE ensures card data is encrypted, always ensure the device is de-registered via your Surfboard dashboard before shipping.

6. Maintenance of the Visitor & Device Log

You are required to maintain a log of anyone who interacts with the device hardware (e.g., a courier or a landlord moving equipment).