PCI Security Standards Council Extension of PCI PTS POI v3 Devices

PCI Security Standards Council Bulletin: Extension of Expiration of the Approval of PCI PTS POI v3 Devices, March 10, 2020.

Due to supply-chain disruptions related to the coronavirus, the PCI Council has extended the expiration date of PIN Transaction Security Point-of-Interaction (PTS POI) v3 devices from 30 April 2020 to 30 April 2021.

For those countries and entities not impacted by the coronavirus, we strongly encourage the deployment and use of next generation solutions such as devices approved to PTS POI v4 or v5 and migrating to POI v6 devices when the standard is released later this year.

On advisement from our industry stakeholders, the Council has determined the preventive controls to stop the spread of the coronavirus will impact previously planned rollouts of POI v3 devices. While recognizing that earlier versions of POI devices may be less robust in withstanding certain of the latest generations of attacks, we do not believe that this limited one-year extension of the approval expiry date for POI v3 devices will materially impact that risk.

The PCI SSC advises merchants, financial institutions, vendors and other users of PTS POI v3 devices, specifically v3 PEDs (PIN entry devices), non-PEDs, EPPs (encrypting PIN pads), UPTs (unattended payment terminal), and SCRs (Secure Card Readers) to contact their device vendors regarding the availability of more recently approved models to use as replacements and in new deployments. Effective 30 April 2021, the affected devices will be removed from the approved POI devices list on the PCI SSC website and listed separately here

Here are examples of credit card terminals with expiring PCI PTS 3.x April 30, 2021:

  • Vx525- Hardware #: M252-5xx-xx-xxx-3
  • Optimum M-5 (Verix)-


  • SCR-710, Mx760 SCR-


  • FD55- M252-1xx-x3-FD1-3
  • VX 690, VX 690B


  • Vx600 Bluetooth/ MPM-100


  • Vx825

OP: 2.x.x

  • Vx675 (VOS)


  • IWL220, IWL250- IWL2xx-01Txxxxx
  • IPP220, IPP280Hardware #: iPP2xx-01Txxxxx
  • ICT220, ICT250- Hardware #:iCT2xx-11Txxxxx
  • iCMP-

Hardware #: ICMxxx-01Txxxxx (Non CTLS) ICMxxx-11Txxxxx (CTLS)

  • Ingenico iSC 250 & TOUCH 250 Hardware #: iSC2xx-01Txxxxx


  • ISC Touch 480

Hardware #: ISC4xx-01Txxxxx (no CTLS)
ISC4xx-11Txxxxx (CTLS)


iPP310, iPP320, iPP350

FD130- Hardware #: T0PXXXXB1CXX4X

The Ingenico is a good example of varying PCI PTS within the same model. The Ingenico iSC TOUCH 250 PCI 4.0 Certified

For a complete list , click here https://www.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices?agree=true PCI Security Standards Council (“PCI SSC”) LIST OF VALIDATED PRODUCTS AND SOLUTIONS

What happens if you continue using an expired terminal?

  • If there is a data breach, the cost of which typically exceeds $1 million, you’ll have no safe harbor because you used expired equipment.
  • Your acquirer could shut you down at any time. They know what type of equipment you have because when your account is established they create a communication connection (TID or terminal identification). It’s happened before. I picked up four new clients in one month that were all shut down by their processor for using outdated equipment and or software. There were left with no way to process at all and felt they should have been contacted to make a change before it happened.

Where can you buy a new terminal?

Buy one from Christine! Never buy a terminal on Ebay or any unknown source. Terminals should ship directly from an authorized entity that also does pin debit encryption. Never let a salesperson or any non-employee install your credit card terminal unless they are PCI Council QIR certified; Level 4 merchants are mandated to only use QIR individuals. The QIR designation belongs to individuals, not companies.

Disclaimer: This is not a comprehensive list and does not include add related data for individual products. Merchants should review current information at the PCI Council web site, pcisecuritystandards.org.

Call Christine Speedy, for all your merchant account, hardware and virtual terminal needs. 954-942-0483, 9-5 ET. Christine is Founder of 3D Merchant Services, PCI Council Qualfied Integrator Reseller (QIR), and is a credit card processing expert with specialized expertise in card not present and B2B payment processing technology. Less than 1% of all merchant services sales representatives are QIR certified. Christine is an authorized independent sales agent for a variety of merchant services and payment technology solutions.

EMV terminal buyers guide

Tips before selecting an EMV terminal for credit card processing. Which is better, desktop or multilane?  Which model is right for my business? Should I buy an extended warranty?

Merchants should be aware that all terminals in this article are EMV ready, but that doesn’t mean you can buy and start accepting EMV immediately. That’s because every terminal model has to be certified to each processor, and that process is woefully incomplete. Sticking with the top brands, Verifone, Ingenico, and Equinox (formerly Hypercom), and models will be the fastest path to accepting EMV.  All processors expect certifications to be complete by the October 2015 liability shift.

Should I buy a desktop or multilane signature capture EMV terminal ?

The answer is not black and white.

Choose multi-lane EMV terminal if:

  • Business to consumer and business to business
  • Mixed card present and card not present
  • Higher risk of fraud and disputes
  • Multiple locations, centralized or remote accounting and reconciliation
  • Using a cloud based point of sale or payment processing solution

Choose desktop EMV terminal if:

  • Merchant sells to consumers
  • Low dollar volume (under $20,000 per month), low fraud risk

If you’re not sure, contact a consultant for advice. The more complex your payment needs, the more likely multilane is a better choice.

Which model should I buy?

Because every terminal has to be certified to every processor for any connection, please contact your relationship manager before making a terminal decision. For example, the CenPOS certification for Verifone MX915 to First Data is for CenPOS only; First Data merchants can’t buy the Verifone MX915 and use with a different virtual terminal, unless it’s also been certified.  Due to time and expense, vendors will likely minimize terminal certifications by model and processor. 

  • Multi-lane- They’re more like a mini computer, and with a higher investment, but there are also more efficiencies and other benefits to be gained. For each brand there are multiple choices, the lowest cost option is suitable for any business, and has the smallest footprint. The Ingenico ISC250 and 350 are especially flat and may require a permanent terminal stand. So far, my customers have had no problems with the Verifone MX915 and its EMV certified today. The Equinox L5200 has also been extremely reliable. The L5200 is the lowest cost unit my customers have extensive experience with.
  • Desktop – Verifone VX520, Ingenico ICT series or First Data

Verifone VX520 terminal with EMV NFC Contactless $99 Sale

VX520 emv NFC verifone terminal

Ingenico ING, iCT220, v3, 160Mb, Dial/Ethernet, Terminal/Printer/PIN Pad/SCR/Contactless and iCT250

ict250 ingenico emv terminal

 First Data FD130 or FD35, a pin pad peripheral; compatible only with First Data. I’ve never been a fan of buying a terminal that is processor specific. There’s a multitude of reasons a business might need to change processors at some point.

Which EMV terminals are compatible with CenPOS payment platform?

  • Verifone MX915 is certified with First Data today;  more processors are in progress.
  • Ingenico ISC 250 will be certified by October
  • Equinox L5200 will be certified by October
  • Check with your relationship manager for compatibility with your specific merchant processor

Should I buy an extended warranty?

For multi-lane, yes.  Without it, repairs are usually 8 weeks plus, and start at $150 average just to assess the problem. That brings the starting price to about $650 with all peripherals, programming, and 5 year warranty. For desktop, it depends on how mission critical it is. If you don’t have an overnight replacement guarantee or backup plan, you’ll have no way to accept payments while out for repair. This might be OK if you have multiple terminals, but not if it’s the only way to accept payments.

Where can I buy terminals?

Your merchant account salesperson can handle everything. If you buy from a 3rd party, make sure it’s a reputable source. Terminals have been injected with malware so buyer beware. Additionally, terminals may need to be injected with confidential pin debit or P2PE keys at a secure approved facility.

Wholesale prices are available through Christine Speedy, 3D Merchant Services,  for all customers using our other services. A new merchant account is NOT required to buy a multi-lane terminal if buying our gateway services;

Click here to learn about the $100 American Express EMV Upgrade Rebate.

Multi-lane signature capture terminals require a payment gateway to function. Contact us for omnichannel payment gateway to use standalone or with light integration to any POS. ERP or accounting software. Our solutions segregate payments from your applications to reduce PCI Compliance scope.


Ingenico telium vs Equinox signature capture terminals review

Aside from specifications, what’s the real user experience of these terminals? Signature capture terminals are rapidly growing with the increase in low cost cloud payment technology to run them. This article compares actual user experience differences. The Equinox L5200 and L5300 and the Ingenico ISC 250 touch and ISC 350 touch review highlights are below.

Ingenico, Verifone, and Equinox (previously Hypercom) are the top three terminal suppliers in the USA, per the US Department of Justice in 2011.  (Verifone wanted to buy Hypercom). They’re likely leaders for signature capture terminals. Hypercom is credited with inventing credit card terminals, changing the world forever. The equipment listed here was designed to be future proof; they’re made to support current and future payment types without the need to replace equipment.

The ISC 250 is the little brother to the ISC 350. The L5200 is the little brother to the L5300. Other than the screen size and physical footprint, the units are nearly identical. Merchants have been quite happy with the cheaper (smaller) terminals. NOTE: IMAGES ARE NOT PROPORTIONALLY SIZED TO SHOW DIFFERENCES IN ACTUAL SIZE.

ingenico isc 250 signature capture terminalmulti-lane signature capture terminal l5200Equinox L5200- aboveingenico iSC350 terminalL5300 signature capture terminal

Pricing* MSRP $891 with key injection, all cables, 1 year manufacturer warranty. Swivel stand $89 extra. Estimated final price $775 with key injection, all cables, standard 3 year manufacturer warranty, optional NFC, and optional 3 year overnight replacement included. Estimated MSRP $991 with key injection, all cables, 1 year manufacturer warranty. Swivel stand $89 extra. Estimated final price $875 with key injection, all cables, standard 3 year manufacturer warranty, optional NFC, and optional 3 year overnight replacement included.
Memory internal: 128 MB flash NAND, 64 MB SDRAMexternal: supporting up to 32 GB internal: 256 MB Flash, 128 MB SDRAMexternal: MicroSD port internal: 128 MB flash NAND, 128 MB SDRAMexternal: supporting up to 38 GB SAME AS L5200
  • main: Thunder (ARM9), 450 MIPS
  • crypro: Booster (ARM7), 50 MIPS
  • 400 mhz, 32 bit
  • video decoder
  • same as ISC 250
  • SAME AS L5200
Display Color: YesSize 4.3”Resolution: 480 x 272Touch screen: Projected capacitive technologyFinger and stylus touch Color: WQVGA, 18-bit, 256KSize 4.3” diagonal display, LCDResolution: 480 x 272 pixels Color 240K colorsSize 5.7”Resolution: 640 x 480, 4:3Touch screen: Projected capacitive technology;Finger and stylus touch Color: WQVGA, 18-bit, 256KSize 5.7” LCDResolution: 640 x 480Touch screen: Integrated capacitive, glass top makes screen brighter and scratch resistant.Optional decorative bezel
Card Reader Standard: MagStripe, Signature Capture. EMV Chip & PIN, Chip & Sign, NFC contactless capable;
NFC supports new payment options including ewallets.
Standard: MagStripe, Signature Capture. EMV Chip & PIN, Chip & Sign capable;  Optional NFC Contactless, supports new payment options including all major ewallets.

Same as ISC250 SAME AS L5200
  • PCI PTS 3.x certified
  • EMV levels I & II
  • Interac
  • PCI Pin 2.0
  • Normative Annex A
PCI PTS 2.x certified
  • SAME AS L5200
Pin debit
  • Optional shield
  • Remote Key Injection service
  • Integrated shield
  • X509 standard public key for device and server authentication, firmware and forms authentication, SSL comm, and remote key injection
  • same as ISC 250
Communications USB 2.0, RS232, ethernet USB and powered USB, RS232, ethernet same as ISC 250 SAME AS L5200
  • Lies very flat. Merchants may need to purchase an optional fixed base and stand to secure device on an angle for viewing. Consider whether this is desirable for the surface where payments are accepted.
  • Requires external power supply. It’s not a single cord but a multi-part power system that increases cable monsters and and troubleshooting problems.
  • Built in angle usually eliminates need for special stand.
  • Powered by communication method- no extra power supply (more cables) needed
  • Innovative pen bracket system keeps pen securely attached to terminal, reducing repairs and support calls. (Manufacturer statement matches our real world customer experiences.)
  • Nice size color display and lowest price signature capture terminal!
  • Glass really does make display pop and mitigate risk of ink and scratch damage.


  • No experience to report.
  • Requires external power supply.
  • SAME AS L5200
  • Buy the L5300 if you have the space and you want a bigger screen. Otherwise the L5200 is suitable for almost any merchant. 99% of my customers buy this unit.


SAM = Secure Access Module slots

* Prices include power supply, cables, software loading, debit key injection, and everything physical needed to plug in the machine and run it.

Merchants also need a payment gateway, such as CenPOS, to securely accept payments and run the terminals. The gateway may enable users to login to a secure web page to process payments; others may require integrated POS software.

MANUFACTURE WARRANTY & REPAIR NOTICE: Because these devices are more like computers than older style terminals, it’s recommended merchants purchase either an overnight replacement solution or have additional units on hand as a back up.

  • The typical manufacturer time to repair units under warranty is 8 weeks.
  • The typical cost to diagnose a unit problem not under warranty is $150.
  • Overnight repair service must be purchased at the same time the unit is purchased. Costs range up to $299 per unit.

Data obtained from publicly available information on the respective manufacturer web sites as of March 2014. In some cases, data was not readily available to compare the exact features, however, the terminal may have them. Merchants are encouraged to conduct their own research for comparative information not covered here and for general fact checking.


Although all terminals were designed to be future proof, they do not support all features out of the box. To accept EMV chip cards, the gateway must certify the terminal to each processor; the same applies for P2PE encryption. Due to the expense and other reasons, some terminals may never be certified for EMV or P2PE.

FD300ti multi-merchant terminal

The First Data FD300 Ti terminal is the ideal solution for operations that want a a desktop terminal  to keep track of sales for separate businesses (as many as 99) that are housed at the same location. Its multi-merchant capability allows each owner to conveniently designate which business the sale is applied to at the time of the purchase. Each merchant receives an individualized statement listing only his own transactions in an easy-to-read format.

FD300ti multi-merchant terminal data sheet (pdf download)

The pin-pad for pin debit is an optional add on. FD30 contactless pinpad provides convenience in busy high volume settings.  The FD10 is about half the price.  Since pin debit is nearly the same cost as signature debit at this writing, smaller service oriented merchants will want to weigh the cost benefit, since chargebacks tend to be infrequent in those industries. Additionally, the actual use of the pin pad tends to be low in multi-merchant settings, negating the potential benefits. Finally, with 2011 pending federal legislation, signature debit may eventually be the same cost as pin debit.

fd300 ti terminal

MSRP $599. Click here for our Credit Card equipment and FD300 terminal price list.


Is the FD100 PCI Compliant?

Yes, the FD100 meets PCI Compliance standards as of this writing. The FD100 is a desktop terminal with built in printer offered by First Data and resellers. The POS terminal delivers high quality transaction processing, and it provides a safe, secure Internet Protocol (IP)/dial-up platform.

This inquiry is probably a result of notices going to merchants about compliance issues with terminals. In many cases, the terminal is compliant, but the attached pinpad (PED) may not be.  See prior article on which pin pads are PCI Compliant.