'They were organized': Toronto employee speaks out after debit machine theft

Why thieves are targeting point-of-sale terminals It took a thief less than nine minutes after stealing a point-of-sale terminal to hack into and issue a fraudulent refund.

A Toronto employee whose business lost $8,000 after their debit machine was stolen is warning others to lock up their devices.

“They are organized and they know what they are doing," Tracey Craig, an employee of the St. Clair East Animal Hospital in Scarborough, said.

The hospital was broken into last month and one of their Point of Sales (POS) terminals was stolen. Security video showed the man who broke in at 5 a.m. appeared to know exactly what he was looking for.

“He came in and smashed the door with a hammer and reached over and fumbled around for the point of sale machine and he was gone in nine seconds.”

Not long after the thief left with the POS terminal, the animal hospital lost money to a fraudulent refund.

“They were able to hack the machine within nine minutes of leaving the facility. They had given themselves an $8,000 refund right out of the doctor’s business account," said Craig.

Toronto police said that about 79 POS terminals were stolen from GTA businesses, including animal hospitals and vet clinics, between Oct. 30 2022 and April 1, 2023.

A suspect, identified as 37-year-old Crystalee Hollihan, has been charged with possession of property obtained by crime over $5,000 in connection with the investigation.

The charges have not been proven in court.

Toronto police said that while the theft of POS terminals has been happening for some time now, there has been a recent spike over the past year.

“Call your payment company right away if your terminal gets stolen and you should also file a police report," said Det. Const. James Cain, a fraud investigator with Toronto Police Service.

Cain said all businesses need to keep a watchful eye on their payment devices.

“At the end of the business hours, lock up the machine and keep it out of sight so it's not on the counter and can be seen from a window if someone walks by," Cain said.

Moneris, Canada’s largest payment processing company, said the best way for businesses to protect themselves is to use security features built into the terminals such as a passcode.

“As long as these terminals have password protection on them which we highly recommend all of our merchants to use, it's very hard for the fraudster to do anything once they actually take the POS terminal,” said Moneris fraud expert Marta Rzeszowska.

Merchants are also advised to set refund limits on the terminals, to warn staff to always remain with customers while they're being used and to tell other businesses the terminals are now a target.

“I would say to warn other businesses that they should lock up those machines. Let's not make it easy for these guys to steal them” said Craig.

While Craig said the animal hospital was reimbursed for the stolen funds, that’s not always the case. Toronto police said that if a business doesn’t use available security features and fails to report a stolen terminal right away, there's a chance they won’t get their money back.