The Terminal That Isn't There: A Bristol Shop's Recovery Protocol for Lost and Stolen Card Machines

Most Bristol independents insure the till float, lock the back door and think about card security in terms of chargebacks. Very few have a plan for the moment the terminal itself is no longer on the counter. It is a small, unremarkable object until it disappears, and then it becomes the most consequential item in the shop: a device that carries your merchant identity, your terminal ID and the ability to take contactless payments under the floor limit without a PIN.

The good news is that the sequence of actions is not complicated. It is simply time-sensitive. What follows is a practical protocol for a business with one terminal, a small team and no one whose job title includes the word infrastructure.

First, establish what has actually happened

Before anyone phones the provider, confirm that the machine has genuinely gone. In a single-site shop on Gloucester Road or a shared unit at Wapping Wharf, the most common explanation is mundane: a supervisor took it home to charge overnight, a cleaner moved it into the safe, a colleague swapped it for the spare during a busy Saturday, or it is still in the jacket pocket of whoever covered the late shift.

Check the safe, the charging drawer, the back office, the other till position and the vehicle. Ask neighbouring traders if a machine has been handed in. Then open your provider's online reporting portal and note two things: the time of the last settled transaction, and the time of the last batch. Those timestamps give you the window in which the device left your control, and every later conversation will depend on them.

If the shop runs an integrated till — an electronic point of sale with the card reader built in or docked — establish whether the whole unit went or only the reader. The difference matters, and not only commercially.

Locking down a machine you cannot see

Phone the provider's helpdesk rather than sending an email. Ask for three things in the same call: immediate blocking of the terminal ID and merchant ID, confirmation that the device is being placed on the hot list, and written confirmation by email before you hang up.

Here is the nuance that catches people out. Many terminals are disabled through a terminal management system, and that instruction takes effect the next time the device connects to the network. A stolen terminal sitting in a drawer, powered off, may remain live for longer than feels comfortable. Ask the helpdesk explicitly what the position is for contactless transactions presented before the block takes effect, whether your floor limit can be set to zero in the interim, and who carries the liability for anything taken in that gap. A short, polite question now is worth a great deal more than a chargeback argument in three weeks.

If the machine was integrated with a till system, treat the loss as a possible data incident as well as a theft. Ask what customer information was held on the device and, where personal data may have been involved, take advice on whether the incident meets the threshold for reporting to the Information Commissioner's Office within 72 hours.

Paperwork worth assembling in the first hour

Gather the following while memories are fresh: the terminal serial number and terminal ID, your merchant number, the date and time of the last settlement, a screenshot of the last transactions, the name of whoever last used the machine, and the time they finished. Export any relevant CCTV footage rather than assuming it will still be there next week — retention periods vary and are often shorter than people expect.

Keep a copy of everything in one folder. Insurers, acquirers and, occasionally, the police will all ask for the same handful of facts, and assembling them twice is a waste of a trading day.

Three calls, in a sensible order

The provider comes first, for the reasons above. The police come second: report the loss through the non-emergency route and obtain a crime reference number, even where attendance is unlikely. Insurers routinely ask for it, and without one a claim can stall.

The insurer or broker comes third. Two questions are worth asking plainly. First, does the policy cover portable equipment, including when it is away from the premises or left on an unattended counter? Second, what is the excess, and is a replacement terminal covered or only the hardware's depreciated value? Many small commercial policies treat a card machine as office equipment, which may not reflect the cost of being offline for three days.

Trading while the counter is empty

A Bristol shop with heavy footfall cannot simply wait. Options, roughly in order of speed: a temporary pay-by-bank or QR arrangement through your bank; a replacement unit dispatched under the provider's rapid-replacement scheme, which typically arrives within one to three working days and may involve a declaration form and a fee; a short-term soft-POS app on a phone, remembering that it is a different product with different pricing and its own security obligations; or, for appointment-led businesses, taking deposits by bank transfer until the hardware returns.

Cash remains lawful tender and a reasonable interim answer, provided the float, the banking routine and the insurance cover for cash on the premises are all in order. Do not borrow another trader's terminal credentials under any circumstances, however friendly the offer.

What will be asked afterwards

Expect questions about the interval between the machine going missing and the block being requested, about whether the device was secured to the counter, and about who was responsible for it at close. Any transaction presented after the loss that you did not authorise should be disputed promptly and in writing, with the timestamps you collected at the outset. Records made in the first hour are the ones that carry weight later.

Making the next disappearance less likely

A few inexpensive habits close most of the gap. Photograph every terminal's serial and terminal ID and keep the images off-site. Anchor the counter unit with a security cable. Run a sign-out sheet for handhelds taken to tables or to the door for deliveries. Include the terminal in the closing routine, named against a person rather than a role. And once a fortnight, check that the device on the counter is the one on your asset register — device substitution is a quiet and surprisingly common form of fraud.

None of this requires a consultant. It requires a plan written down before it is needed, and a shop that knows who makes the first phone call.