While looking at our Uber Eats interface, I researched how secure the platform is and discovered several operators had reported security issues here. This one, however, caught my eye. As bad as some bank fraud scams are, it is too easy to forget that as services get linked into your POS System, the chances of fraud increase with other systems.

A typical bank fraud hit many Uber Eats franchises, but because it was not a bank, the owners let it go until it was too late.

The scammers posed online as Uber Eats administrators, claiming urgent account issues. They then requested login credentials to "fix" some supposed problems. Once access was gained, the Uber Eats franchises' banking details were changed to redirect payments. Unlike bank systems, Uber Eats' notification systems often fail to alert merchants about these changes, which is weird as one would assume these are critical.

Real-World Impact

An Uber Eats merchant lost $3,500 after scammers changed their banking details. Another reported losing over $20,000 through a similar scam.

Security Measures to Implement

To safeguard your business from these scams, implement the following security measures:

Enable Multi-Factor Authentication (MFA)

You can add an extra layer of security by requiring multiple verification forms before account access is granted.

Implement Strict Internal Controls

Limit access to your codes to trusted staff only. Change these frequently and immediately when staff members leave your business.

Verify All Communications

Today, few security people request passwords or banking details via phone, text, or email. I would be cautious if they contacted you first. If you must give them passwords, change these passwords ASAP. Here are some tips.

Monitor Your Account Regularly

If possible, check your banking details and payment receipts daily. Your total report should match the bank's records.

Use Strong, Unique Passwords

Create complex passwords specific to your Uber Eats account. I recommend using a reputable password manager to generate and store secure credentials.

What to Do If You've Been Hacked

If you suspect your account has been compromised, immediately change your passwords. Contact the company through official channels, not by replying to an email. Document everything. Report the incident to your bank. Consider freezing payments until security is restored.

Legal Responsibilities and Compliance Australian law clearly states that you are responsible for your financial and customer information.

I had a client, World Square Newsagency, who went to court over fraud committed not by him but by one of his employees. The judge ruled that he had to pay the NSW lottery $574,000 for the employer theft, the NSW lottery legal fees, the NSW lottery investigation costs, and his legal fees of about $200,000 and some other expenses. It added up to over a million dollars.

Details here.

The Bigger Picture for Australian Retailers

While this article focuses on Uber Eats, the security principles apply to all integrated payment systems. Each new integration will create potential security risks, which require vigilant management.

Written by:

Bernard Zimmermann is the founding director at POS Solutions, a leading point-of-sale system company with 45 years of industry experience. He consults to various organisations, from small businesses to large retailers and government institutions. Bernard is passionate about helping companies optimise their operations through innovative POS technology and enabling seamless customer experiences through effective software solutions.

I have seen how retail frauds severely impact retailers. As a retailer with a brick-and-mortar store, you're likely aware of the various business challenges. Void fraud is one of the worst threats to your business, as it attempts to bypass the security in your POS system. 

What is POS Void Fraud?

POS void fraud is a sneaky tactic where unscrupulous workers process a sale, take the customer's money, and then erase the transaction from the system, effectively taking the cash without leaving evidence.

The Mechanics of Void Fraud

Here's how it typically works:

1. The employee processes a legitimate cash sale. 
2. They void the transaction after the customer leaves
3. The cash is pocketed, and no record of the sale remains
4. End-of-day totals appear to balance. 

It's a sneaky tactic that can be hard to spot without the proper controls. 

Customers returning with queries about purchases not in the POS system are the primary method of catching these people. To make this legally stick, you need cameras on the till. This appears to be the only evidence the courts now accept.

Red Flags to Watch For

In my experience, several warning signs might help indicate void fraud is occurring:

• An unusually high number of voided or no-sale transactions
• Voids and no-sales happening at odd times or consistently by the same employee
• Frequent voids for high-value items
• Suddenly, low rates of cash

Suspicious Employee Behaviour

Be on the lookout for staff members who:

• Frequently process transactions without customers present
• Insist on handling specific customers or transactions themselves
• Are overly protective of their register or reluctant to take breaks
• Want to work alone? 

Regular audits and rotating staff assignments can deter potential fraudsters.

POS fraud prevention

1. Implement Strict Void Policies

• Limit void permissions: Only allow trusted senior staff to process voids
• Require approval: Set up your POS system to need manager approval for voids
• Document reasons: Make it mandatory to record a reason for each void

2. Utilise Technology

Modern POS software offers powerful tools to combat fraud:

• Real-time alerts: Get notified instantly of suspicious void patterns
• Integrated camera systems: Link transactions to video footage for easy review
• Detailed reporting: Analyse void trends and identify potential issues

3. What to do

• Do not ignore the seriousness of void fraud
• Proper cash handling procedures
• Spot and report suspicious behaviour
• Review your security camera footage regularly, mainly when a person is alone.
• Conduct frequent, unannounced audits of  Void and No-sale transactions

A Personal Anecdote

I once worked with a small newsagency that discovered they were losing thousands of dollars to void fraud. The employee was ringing up transactions in the customer section, issuing receipts and then voiding the transaction in the cash register. We cut their losses almost immediately, needless to say, the owner.

Retail fraud detection

The first point is to check whether many of these voided transactions are occurring and when and who is doing them.



Easy enough to do: go to main menu > Cash register > Transaction Enquiry (see green arrow)

Conclusion

While POS void fraud poses significant problems, implementing effective strategies and our cutting-edge tools can safeguard your business. Remember, proactive measures trump reactive ones.

Picture this: A customer walks in, claiming they bought an item months ago. There is no receipt, no proof, just a story. Sound familiar? I had a customer who told me that is precisely what happened. A person entered his shop and demanded his money back on a book. He looked at his sales history and found nothing, so he told the guy, who promptly ran out of the shop. 

You probably want to read about Kmart's new policy, which will change this scenario forever. Kmart has tightened its refund process and now requires proof of purchase for all "change of mind" returns, such as copies of receipts, Bank statements, Buy Now Pay Later statements, Flybuys statements, etc. 

Time Frame: Must be made within 60 days unless the people are in its VIP program members:

Original packaging: Required plus the instruction manuals and all accessories

Non-refundable items: Some products, like cosmetics and printer cartridges, are excluded from "change of mind" refunds

More details here.

Next Step for Your Business

I suggest consulting your industry group before taking any action. They can provide valuable insights on best practices and legal considerations. Then, it will be time to take action. Your refund policy should do double duty: shield your business and nurture customer faith. Nail this balancing act, and you'll create an environment where your success and customer satisfaction go hand in hand.

Written by:

Bernard Zimmermann is the founding director at POS Solutions, a leading point-of-sale system company with 45 years of industry experience. He consults to various organisations, from small businesses to large retailers and government institutions. Bernard is passionate about helping companies optimise their operations through innovative POS technology and enabling seamless customer experiences through effective software solutions.