Is Your Credit Card Machine Putting Your Customers at Risk? Dial-Up Terminals, PC Registers and Texting Card Numbers (2026)

By Jason Hanson, Owner, Berry Payments (EPOS LLC), North Plains, Oregon.

Quick answer: The safest way to take cards is on a dedicated, encrypted device that does nothing but run your business. Clover devices encrypt card data the moment a card is tapped, inserted or swiped, replace the card number with a token, and don't come with a web browser for employees to wander around the internet on. Old dial-up terminals and registers that double as the office PC are two of the biggest risks I still see. And never text a card number, even from an iPhone.

I've been in the payments business since 1998. On service calls I still walk into shops running a dial-up terminal plugged into a phone jack, or a register that's also the computer where the staff checks email and watches videos on break. Both work fine right up until the day they don't. Here's what's at stake and what to do about it.

What does "encrypted at the point of sale" mean?

When a card is tapped, inserted or swiped on a modern terminal, the card number is scrambled inside the device before it goes anywhere. Only the payment processor can unscramble it. If someone intercepts the data along the way, they get gibberish.

Tokenization adds a second layer. Once the sale goes through, the real card number is replaced with a token, a stand-in code that's useless to a thief. Your system keeps the token for refunds and reports, never the card number itself.

Clover devices use both encryption and tokenization. That means the card number isn't sitting on your device or your network waiting to be stolen.

Why old dial-up terminals are a risk

• They were built before today's protections. Most dial-up terminals send card data over a phone line without the end-to-end encryption and tokenization modern devices use.

• Many can't read chips or take tap-to-pay. Since October 2015, if a counterfeit chip card is swiped on a terminal that can't read the chip, the business can be stuck paying for the fraud.

• The phone lines are going away. Phone companies are retiring old copper landlines, and the FCC made that easier for them in 2025. When your line is shut off, your terminal stops taking cards that day.

• Old devices stop getting security updates. Card security standards keep moving, and older terminals eventually lose support from manufacturers and processors.

Why a PC register is riskier than a dedicated device

A Windows PC that runs your register is also a computer people use for everything else. Employees check personal email, browse, click links and download things. That's how malware gets in, and some malware is built specifically to steal card numbers from checkout systems.

That's not a theory. In 2013, attackers put malware on Target's checkout registers and stole about 40 million credit and debit card numbers. Small businesses get hit the same way. They just don't make the news.

A PC-based register also puts the whole computer, and often your whole network, in the scope of your PCI security requirements. That means more updates, more antivirus, more things that have to go right every day.

Why a dedicated Clover device is safer

• Encryption and tokenization built in. Card data is protected from the moment the card touches the device.

• It only does one job. Clover devices don't come with a web browser, and apps install only from the Clover App Market, where Clover approves them. Nobody's surfing the web or opening email attachments on your terminal.

• Updates happen automatically. Clover pushes software updates to the device, so you're not relying on someone remembering to run them.

• Chip, tap and mobile wallets. Apple Pay, Google Pay and contactless cards are some of the most secure ways to pay, because the real card number never gets shared with your business.

• No phone line needed. Depending on the model, Clover runs on Wi-Fi, Ethernet or a built-in cellular connection.

• Easier PCI compliance. With a dedicated, encrypted device, your annual PCI questionnaire is simpler. At Berry Payments, we fill it out for you so you never get hit with PCI non-compliance fees.

Don't text card numbers, even from an iPhone

This one surprises people. Here's how it actually works:

• Blue bubbles (iMessage) are end-to-end encrypted. Messages between two iPhones are scrambled so only the sender and receiver can read them.

• Green bubbles marked "Text Message" are regular SMS, and they're not encrypted. Your phone carrier can read them, and so can anyone who intercepts them or gets into the carrier's systems.

• iPhone-to-Android texts are changing in 2026. With iOS 26.5, Apple and Google started rolling out end-to-end encryption for RCS messages between iPhones and Android phones. It only works when both phones are updated, both carriers support it, and you see a small lock icon in the conversation. No lock means no encryption.

Even when a text is encrypted, the card number stays in the message history on both phones, in phone backups, and on any phone that gets lost or passed to a new employee. PCI rules don't allow card numbers to be sent through unprotected messaging, and the safest rule is simple: don't text card numbers at all.

If a customer needs to pay remotely, use Clover's Virtual Terminal or send them a Clover payment link, and they enter their own card. If they call it in, key it straight into your Clover and don't write it down.

One more thing: Berry Payments will never call, text or email you asking for your card numbers or account passwords. If someone does, it's a scam.

Quick security checklist for your business

• Take cards only on a dedicated, encrypted device, not a shared PC.

• Retire any terminal that plugs into a phone jack.

• Make sure your terminal reads chip and tap.

• Don't let staff use the register for email, browsing or personal apps.

• Never text, email or write down full card numbers.

• Keep your annual PCI questionnaire current.

• Only download apps from your POS provider's official app store.

How Berry Payments helps

• Free Clover equipment for qualifying merchants: a free Clover Flex, Flex Pocket, Compact or Mini at $10,000 a month in card sales, or a free Clover Station at $25,000. See the full lineup and your price.

• Free setup and delivery, and we'll help you retire the old terminal.

• We complete your PCI questionnaire for you.

• Free local support by phone or text, and a free 24-hour terminal swap.

• No long-term contracts and no early termination fees.

Still running dial-up or a PC register?

Call or text (888) 560-9025 and tell me what you're using now. I'll tell you straight whether it's putting you at risk and what it would take to switch. We serve merchants in Portland, across Oregon and Washington, and nationwide. Get started here.

Frequently asked questions

Are dial-up credit card terminals still safe to use?

Most dial-up terminals were built before end-to-end encryption and tokenization became standard, many can't read chip cards, and the copper phone lines they depend on are being retired. If you're still on dial-up, it's time to upgrade.

Is it safe to run my credit card machine on a regular PC?

It's riskier than a dedicated device. A PC used for email and web browsing can pick up malware, and some malware is designed to steal card numbers from checkout systems. A dedicated, encrypted device like a Clover keeps payments separate from everyday computer use.

Does Clover encrypt credit card numbers?

Yes. Clover devices encrypt card data when the card is tapped, inserted or swiped and use tokenization so the real card number isn't stored on the device.

Is iMessage end-to-end encrypted?

Yes. iMessages between iPhones, shown in blue bubbles, are end-to-end encrypted. Regular SMS text messages in green bubbles are not.

Are texts between iPhone and Android encrypted?

Only in some cases. Starting with iOS 26.5, RCS messages between iPhones and Android phones can be end-to-end encrypted when both phones are updated and both carriers support it. Look for the lock icon in the conversation. Regular SMS texts are not encrypted.

Can I text a customer's credit card number to my business phone?

You shouldn't. Card numbers sent by text stay in message history and phone backups, and PCI rules don't allow card numbers to be sent through unprotected messaging. Use a virtual terminal or a payment link so customers enter their own card.