FBI investigates Chinese payment device maker

FBI investigates world’s 3rd largest POS payment device company

In late 2021, the FBI said in a statement that it was “executing a court-ordered search to further expand the federal investigation.” Participating in the investigation were the US Customs and Border Protection,…

Network security information page KrebsOnSecurity PAX is the subject of investigation because there are many indications that its devices are used in cyber attacks. The FBI began an investigation after discovering unusual data packets originating from PAX payment terminals. Currently, the FBI and MI5 are still continuing to conduct in-depth investigations.

“PAX POS devices sent encrypted data that is not necessary for normal payment processing to third parties in China,” the Treasury Department said.

Data transfers happen more frequently and have a larger capacity than regular payment transactions. The U.S. Department of Treasury’s preliminary assessment of data transmission using these devices presents a potential risk to the security of customer data.

On October 27, 2021, the payment processing magnate – FIS World Pay also announced the removal of PAX devices in the system, due to concerns related to safety and security, when the devices PAX-provided POS devices have connected to websites that are not on the list provided by PAX.

PAX Global Technology Limited is a China-based investment company whose main products are electronic payment terminals (POS Machines) and the world’s third largest payment solution, after US firm Verifone and French Ingenico.

Founded in 2000, PAX listed on the Hong Kong Stock Exchange in 2010 and has sold over 60 million devices in 120 countries around the world. PAX currently occupies a sizable market share in Latin America. PAX’s major customers from China include UnionPay, Bank of China, Agricultural Bank of China, Telecom Bank and telecommunications carrier China Mobile.

Concerned about information security on PAX’s POS device

Previously, another case similar to the PAX incident, in March 2021, the US Federal Communications Commission determined that certain telecommunications products and equipment threatened national security such as Huawei, ZTE and Hikvision. will be removed. The reason given is that these companies have produced telecommunications products, equipment and services that will pose risks to the national security and safety of the citizens of the United States.

Given these security risks, the question is, is PAX like Chinese telecommunications companies like Huawei, ZTE and Hikvision that have been blacklisted by the US because of security risks?

In Vietnam, PAX is currently the largest POS supplier to about 40 banks and payment service companies. Millions of transactions are being made via POS daily.

It can be seen that the payment equipment provided by PAX is being used in Vietnam, but there is a potential risk of information security for the payment market. It is not difficult to understand when customers feel concerned that the card machine commonly found at payment points may be a “spy waiting for time”.

Hai Minh (aggregation| Bloomberg, Krebsonsecurity)