Toronto Business Owners Lose Thousands in POS Refund Scams

A wave of POS refund scams have blindsided small businesses in Toronto, with at least two Queen Street East shops reporting thousands of dollars stolen through deceptively simple tactics involving their own payment terminals.

Customer Issues Himself $2,000 Refund

At the family-owned Souvlaki Hut in The Beaches, a man approached the counter pretending to make a purchase. Instead, he quietly picked up the POS terminal and issued himself a manual refund of $2,000. Security footage shows the man lifting the device slightly — just enough to block the staff’s view.

“It was shocking,” said Artie Jorgaqi, whose mother owns the shop. “My mom works so hard, and just like that, it was gone.”

Jorgaqi later learned they could have prevented the refund by adjusting the terminal’s settings — but no one had warned them to lock down these features manually.

Another $4,900 Taken from Tea Shop

Just blocks away at Pippins Tea Company, a similar scam played out. A young man claimed to be buying a teapot for his grandmother. Instead, he issued a $4,900 refund to a card he controlled.

“It was just sick,” said owner Barbara Deangelis. “That kind of loss hits hard when you’re a small business.”

Luckily, Pippins’ POS vendor Moneris reversed the charges and returned the money, though not every vendor has responded as quickly. Clover, the vendor used by Souvlaki Hut, had not responded to inquiries as of Wednesday.

Security Flaws in POS Terminals

Experts say these scams exploit common weaknesses in POS machines. Cybersecurity specialist Claudiu Popa described many POS systems as “misconfigured from day one.” Most terminals use default passcodes or insecure permissions, making them easy targets for tech-savvy thieves.

“This is like someone unlocking your phone and helping themselves to your mobile payments,” said Popa.

Many businesses don’t realize they must manually configure refund permissions, transaction limits, and authentication layers during setup. Many leave those settings untouched.

Officials and Police Respond

The scam continues to spread. Niagara Regional Police recently warned local businesses after reports of similar refund frauds across the region. Criminals have reportedly stolen, swapped, or tampered with terminals, redirecting large refunds to their own accounts.

In Toronto, Deputy Mayor Mike Colle previously raised alarms over a similar wave of frauds in areas like Bathurst, Dufferin, and Eglinton. He urged businesses to lock up terminals, remove them from counters when unattended, and change PIN codes weekly.

“This is a new level,” said Lori Van Soelen, manager of The Beach BIA. She encouraged all local businesses to assess what their terminals allow — and lock down what they shouldn’t.

What Businesses Can Do Now

Security professionals and police departments recommend the following steps:

• Secure devices: Lock terminals away after hours; never leave them unattended.
  
• Password protect refunds: Set strong passwords for refunds and voids, requiring manager-level access.
  
• Monitor activity: Watch for suspicious refund trends or activity on multiple devices.
  
• Inspect for tampering: Look for loose hardware, unusual overlays, or changes to device behavior.
  
• Upgrade systems: Use encrypted and contactless-enabled terminals. Avoid magnetic-stripe-only setups.
  

As for the Souvlaki Hut, Jorgaqi hopes their story serves as a warning. “If we had known these settings weren’t locked by default, we would’ve changed them,” he said. “The vendors need to do more, too. Put refund limits, require two-step confirmation—anything.”

For now, awareness may be the best protection.

Do you think POS terminal vendors should take more responsibility for refund security, or should business owners handle it themselves?

More…

• https://www.notllocal.com/police-beat/niagara-police-warn-businesses-of-rising-pos-terminal-fraud-10850843
• https://www.ctvnews.ca/toronto/article/it-was-a-shock-toronto-business-owner-says-customer-used-point-of-sale-terminal-to-issue-himself-2000-refund
• https://www.cp24.com/local/toronto/2025/07/03/it-was-a-shock-toronto-business-owner-says-customer-used-point-of-sale-terminal-to-issue-himself-2000-refund