The owner of a Vancouver salon has a warning for other businesses after a fraudster managed to steal nearly $5,000 in a matter of seconds. Joseph Jawhari, who has owned Pink Lime Salon and Spa in Yaletown for decades, said he’s never encountered anything like it in all his years of doing business. The incident started when a man came in and approached the counter to purchase a $20 hairbrush. “They went to put it on their credit card, but they took the machine and instead of them putting their PIN number, they refunded themselves $4,900,” Jawhari said. In the retail world, this type of fraud is known as device manipulation. After altering the terminal to process a refund instead of a payment, the man tore the receipt from the machine and abruptly left the salon—leaving the hairbrush on the counter. Jawhari reported the theft to Vancouver police when it happened in April. Since then, he’s been involved in a lengthy back and forth with Moneris, the company that processes the transactions. He’s finally getting the $4,900 back but the company did not agree to that until being contacted by CTV News this week. “I just want all the business to be aware of what’s going on and really have your cameras,” he said, pointing to the salon’s surveillance system. “That helps always because that’s the only way you’re going to identify the clients coming into your salon.” Since speaking with Jawhari about the fraud, CTV News has managed to track down one business in Alberta and two in Ontario that have fallen victim to the same scam. Each of the businesses provided security videos and images showing the same man who scammed Pink Lime, using the same technique to steal thousands of dollars from them in the time it takes to process a transaction. In Belleville, Ont., the suspect hit a shop called T-Shirt Explosion. The man got away with $4,999.99—just one cent below the refund limit on the machine. “$5,000 being taken can make or break a business. It can easily close a small business. So, of course it was scary hearing about it (from staff). And it was just a terrible scenario,” said Abbygale McNeil, the store’s manager. The owner of a burger restaurant in Cambridge, Ont., did not want to go on the record for this story. He had the refund limit on his machine set to $100—but an over-the-air software update reset it to $5,000. The thief managed to scam the restaurant for $4,900. The business owner said Moneris eventually refunded him the money, but not before he threatened to go to the media. Claudiu Popa, CEO of Data Risk Canada, says scammers are constantly sharing information with each other, and even using AI tools to learn about ways to manipulate point of sale terminals. In an interview with CTV News, he said automatic software updates are just one of the vulnerabilities that criminals can exploit to commit fraudulent transactions. “Even if those POS devices have been hardened or secured in the past, that security is often overridden now that the patch or update has been applied,” Popa said. He recommends businesses change default settings and passwords when setting up their point-of-sale systems. “Unfortunately, default passwords and shared administrator credentials are still in widespread use across Canada,” Popa said. “So, unfortunately, that continues to be a really prevalent type of fraud.” CTV News also spoke with the owner of a day spa in Edmonton that lost $4,900 to a man pretending to pay for a gift card but issuing himself a refund instead. This business also preferred to stay off the record but provided CTV News with security video showing the same man who had targeted each of the other businesses. Some of the victims who spoke to CTV News have been compensated by Moneris, but the day spa has not.
