In Brazil, Payment Terminals Ship With Default Keys

Brazil's card payment market runs on tens of millions of terminals, and a meaningful share of them leave the factory with the same cryptographic keys they will use in the field. That single engineering shortcut reshapes who pays when fraud happens, and it is worth understanding before the next terminal refresh.

The Default Key Problem in Brazilian POS

Payment terminals ship with factory-set credentials: a default administrative password, a default transport key, sometimes a default application key. The manufacturer does this so the device can be staged, tested, and shipped without a per-unit key ceremony. On a production line moving thousands of units a day, unique keys per device cost time and money.

Merchants rarely change them. A small shop owner in São Paulo receives a terminal from an acquirer, plugs it in, and starts taking cards. The setup menu that would rotate the transport key is buried, documented in a language the owner may not read fluently, and offers no immediate visible benefit. Nobody rotates a key that appears to be working.

Attackers scan for known defaults. Default credential lists circulate for network gear, cameras, and routers; payment terminals are no different. A terminal reachable on a shared network with a factory password is a target, and the attacker does not need physical access to try it.

A single breach scales across estates. When a default key is shared across a model line, one leaked value opens every terminal of that model that never rotated. The blast radius is not one merchant. It is every merchant who took the default, which is why this class of exposure is an acquirer-level problem rather than a shop-level one.

Why Manufacturers Chose Convenience

Faster deployment for small merchants is the honest reason. Brazil's card acceptance expanded rapidly into micro-merchants, delivery drivers, and market stalls. A terminal that requires a key ceremony before first sale adds friction to exactly the merchants least equipped to handle it.

Lower support costs for vendors matter more than they appear. Every unique key is a record that must be stored, escrowed, and recoverable when a device is replaced. A shared default collapses that support burden to near zero. The manufacturer's incentive is to minimize calls to the help desk, and default keys do that.

Certification focuses on hardware, not keys. Payment scheme approvals check tamper resistance, PIN entry, and physical security. Key lifecycle management is often assessed at the acquirer level, not the factory floor, which leaves a gap between the device as certified and the device as deployed.

The Brazilian market demands low-cost terminals. Competition among acquirers and manufacturers pushes unit cost down, and cryptographic provisioning is a line item. When a merchant compares two terminals on price, the one with a cheaper provisioning process wins, and the savings come from somewhere.

There is a counterargument worth taking seriously: unique per-device keys would require a public key infrastructure that many small manufacturers cannot afford to operate. Remote key injection over the network is possible, but it introduces its own risks if the initial transport key is weak. The trade-off is real, and it explains why defaults persist even when everyone knows better.

The Economics of Insecure Terminals

Acquirers absorb fraud losses in most Brazilian card arrangements. When a terminal is compromised and transactions are manipulated, the acquirer typically eats the loss rather than the merchant, because the merchant had no realistic way to detect the compromise. That arrangement removes the merchant's incentive to rotate keys.

Merchant chargebacks hurt small businesses differently. Even when the acquirer covers the fraud, the merchant faces disputes, frozen settlements, and time lost to paperwork. A market stall with thin margins can lose more from a week of blocked receivables than from the fraudulent amount itself.

Insurance premiums rise with weak controls. Cyber and crime policies increasingly ask about terminal provisioning and key rotation. An acquirer that cannot document rotation faces higher premiums or exclusions, which is a cost that eventually reaches merchants through fees.

PCI DSS compliance is unevenly enforced. The standard governs how cardholder data is stored, processed, and transmitted, and it expects key management controls. Enforcement in Brazil has tightened, but a terminal with a factory default can still pass an assessment that looks at paperwork rather than the live key store.

A Documented Case: Cielo and Getnet

Researchers found shared default keys in terminals sold by major Brazilian acquirers, including Cielo and Getnet. The finding was not a single device quirk. It was a provisioning practice: multiple models shipped with the same default key material, and merchants had no prompt to change it.

Affected models sold widely in Brazil. These were not obscure devices. They were the terminals a merchant receives when signing up for card acceptance, distributed through the acquirers' own logistics and through retail channels.

Vendors issued patches after disclosure. The response followed the usual coordinated pattern: researchers report, the vendor develops a firmware update, and the fix is pushed or scheduled. Patching is the easy part when the device can reach a network.

No public tally of compromised devices exists. That absence is the quiet problem. Without a count, no one can say whether the exposure was theoretical or already exploited, and merchants cannot assess their own risk. The uncertainty itself has a cost, which is why this site has argued that certifications without shipped code tell you less than they appear to.

Supply Chain Risks Beyond the Terminal

Third-party integrators manage keys in many deployments. A terminal is not an island. It connects to a payment application, often supplied by an integrator who holds the keys, configures the device, and may retain remote access for support. That access is a supply-chain dependency the merchant never sees.

Firmware updates lack signature checks on some models. If a device will accept an unsigned update over the network, an attacker who reaches it can install code rather than merely read data. Signed firmware is the control that prevents this, and it is not universal.

Logistics partners handle devices in transit. A terminal that sits in a warehouse, a van, or a retail stockroom before activation is physically accessible. If the device ships with default keys, physical access during transit is enough to prepare it for later misuse.

Contract terms rarely assign key ownership. The merchant agreement typically covers fees, settlement timing, and chargeback liability. It seldom says who owns the transport key, who rotates it, and who is liable if it is never rotated. Ambiguity in a contract becomes a dispute after an incident.

Practical Steps for Merchants and Acquirers

Rotate default keys before deployment. The acquirer or integrator should perform the rotation as part of staging, before the terminal reaches the merchant, and record the change against the device serial. A default that never leaves the staging bench is a default that cannot be scanned.

Demand signed firmware updates. Ask the manufacturer whether the terminal verifies a signature before applying an update, and get the answer in writing. A device that accepts unsigned updates over the network is a device that can be rewritten by anyone who reaches it.

Audit third-party integrator access. List every party with remote access to the terminal or its keys, and review that list on a schedule. Access granted for a 2023 deployment often persists long after the integrator's contract ends.

Include key management in contracts. Specify who owns each key, who rotates it, how often, and what happens when a device is replaced or returned. This is the clause that decides who pays after an incident, and it is cheaper to negotiate now than to litigate later.

Monitor terminal traffic for anomalies. A terminal that suddenly connects to an unfamiliar host, or transmits outside its normal pattern, is worth investigating. The related piece on foundation maintainers outnumbering corporate contributors makes a similar point about visibility: the people and systems watching the edges are the ones who notice drift first.