A growing number of small businesses in Toronto’s east end are reporting losses of thousands of dollars due to a wave of point-of-sale (POS) system scams. These thefts have prompted the local Business Improvement Area (BIA) to issue urgent warnings and offer guidance on how to better secure POS terminals.

POS Theft Hits Toronto's Beaches Neighbourhood

Lori Van Soelen, manager of the Beach BIA, said she was first alerted to the scam roughly three weeks ago when a business owner shared a troubling experience. A customer claimed the tap feature wasn’t working on the POS terminal and said they’d return—but never did. Later, the owner discovered that someone had issued a fraudulent refund of nearly $5,000 using the terminal.

Since then, Van Soelen says up to seven businesses in the Beaches neighbourhood have reported being victims of similar POS refund scams.

“Many of these POS terminals come with a default password, and if owners don’t change it or activate full security settings, they’re vulnerable,” Van Soelen explained. In several cases, scammers correctly guessed passwords or swapped the terminals entirely with their own look-alike devices when the staff wasn’t looking.

Van Soelen suspects more than one person is involved, calling it an organized and widespread operation.

“Independent businesses are taking the biggest hit,” she said. “They don’t have the corporate safety nets or resources to absorb these kinds of financial losses.”

NaNa Florist Among Victims of POS Terminal Swap

Shiro Maruo, co-owner of NaNa Florist near Danforth Avenue and Main Street, experienced a theft on June 21. Two men entered the store under the pretext of buying flowers but left empty-handed. Shortly after, Maruo received an alert from Clover, his payment processor, saying the manager’s code had been changed and a $2,000 refund had been issued.

Security footage later confirmed that the men had swapped the POS terminal. After contacting Clover, TD Bank, and the Toronto Police, the funds were frozen before they reached the fraudster’s account. Clover has promised to refund the $2,000, but all sales between June 20–23 remain held by the bank, affecting cash flow.

“We did everything right after the fact, but it still cost us time, stress, and money,” said Maruo.

Toronto Police and POS Vendors Respond

Toronto police confirmed that POS terminal theft is the key method being used in these scams. Authorities are urging business owners to keep devices out of customers’ reach, especially during transactions.

Clover Canada said it is working closely with affected merchants and emphasized that businesses can customize security settings, including disabling refunds, setting transaction limits, and assigning permissions per staff member.

Despite this, cybersecurity expert Claudiu Popa says vendors share responsibility:

“When these machines are delivered, they should be secure by default. Passwords should be changed and refund settings disabled. Then, teach the merchant how to manage it.”

Popa added that such scams were once rare, but thieves are now targeting multiple shops in one sweep, making POS fraud far more lucrative.

POS Refund Fraud Spreading Across Ontario

This scam isn’t limited to Toronto. POS thefts are spreading across Ontario, hitting both independent and franchise businesses alike.

Vincent Kang, franchise director of Halibut House Fish and Chips, said four of their 43 Ontario locations were hit, resulting in $6,000 in stolen funds and $3,000 in replacement POS devices.

The first theft occurred in Oshawa. Kang quickly warned other franchisees, but within 48 hours, two more locations—Thornhill and East York—fell victim.

“These scams are devastating. Many small businesses are already operating on tight margins. One incident like this could put them in serious trouble,” said Kang.

Tips to Prevent POS Terminal Theft

If you operate a retail or hospitality business, here are key precautions to prevent POS scams:

1. Change Default Passwords Immediately – Never leave POS systems on factory settings.
2. Restrict Access to Refunds – Limit refund permissions to managers only.
3. Keep POS Devices in Sight – Never leave terminals unattended or within easy reach of customers.
4. Audit Terminal Settings Weekly – Regularly review refund logs and staff access settings.
5. Use Security Tethers or Mounts – Make terminal swaps physically difficult.
6. Enable Real-Time Alerts – Set up notifications for refunds or setting changes.

A Call for Awareness and Action

With these scams escalating, local BIAs and cybersecurity experts stress the importance of POS security awareness.

“These aren't just minor inconveniences—they're targeted, deliberate, and financially damaging attacks,” said Van Soelen. “If you're not thinking about POS security now, you absolutely should be.”

Final Thoughts

POS system security is no longer optional—it’s essential. With scams on the rise, taking a few proactive steps could save your business thousands of dollars and months of stress. Stay alert, secure your systems, and educate your staff.

Source: [Link]