Credit card accepting devices that don't accept PIN

[thuber]

We have table top devices that are used to swipe credit cards, store the card data, and even transmit credit card data to the processor.
They do not accept PIN numbers (a separate pin pad device is available for that). In some cases they are connected through dial-up, but they can also be connected using ethernet. (For example the FD100)

Why are these devices not considered a payment application and falling under PABP? I understand that they don't fall under PCI PED because they don't accept Pins.

[mdahn]

@thuber, I'm not certain what you are referring to. All systems that store, process, or transmit credit card data are within scope for PCI DSS compliance. If the item is a hardware device with no intelligence or storage then the focus for validation may be on the software interfacing with the device.

[thuber]

It is a hardware device, but it certainly has it's own processor and stores credit card data. I'm referring to devices like the FD100 or the Ingenico 510. You see them at retail locations sitting next to the cash register.
I understand that as a retailer, they'd be included in my scope for PCI compliance. However, I don't understand what standards (ie PABP, PCI PED) these devices have to comply with. They are not being included in either of these standards.

[wconway]

A previous thread http://forum.pcianswers.com/showthread.php?t=304&highlight=terminal got at some of what I think is your question (which I read as "where do I get a list of POS terminals that are PCI compliant or at least do not store CHD?") There also is a discussion of terminals that truncate the PAN in the Regulatory Compliance section http://forum.pcianswers.com/showthread.php?t=382. Maybe these would be of help?

[andrewj]

Devices tha communicate card data across an open wireless or IP connection are in scope of the MasterCard POS Terminal Security (PTS) requirements. You can find out more about this here:
http://www.mastercard.com/us/merchant/security/what_can_do/pts_program.html

I am also a proponent of the software for these devices being considered under PA-DSS, but this is generally not the concensus. However, as a minimum, your auditor (either internal or external) should check that these devices do not have a hidden menu mode that allows for the 'dumping' of transaction data.