Merchants are a frequent target for cybercriminals who specialize in stealing credit card information. These criminals sometimes only need to call a business, pretending to be a technician from the payment service provider, to capture customer data at the moment of payment. In France, in-store payments are the category least affected by banking fraud, with a fraud rate of 0.009% in the first half of 2025, according to the Observatoire de la sécurité des moyens de paiement of the Bank of France. However, the Cybermalveillance.gouv.fr 2025 activity report shows a 45% increase in hacking attempts targeting professionals, out of a total of over 504,000 assistance requests received in 2025 across all audiences. Cybercriminals can call merchants, pretending to be a technician from their payment service provider, and request a remote intervention on the payment terminal, using software like AnyDesk. They may also pressure merchants to replace their device. The bank LCL lists this impersonation of a technician among the main frauds reported by French merchants in 2025. Cybermalveillance.gouv.fr also observes a 159% increase in frauds involving fake bank advisors and a 517% increase in phone number impersonations in 2025. Cybercriminals increasingly use methods like WhatsApp to support their fraudulent calls before requesting an intervention on a terminal. They also operate without installing software, with one person distracting staff while another swaps the terminal with an identical, reprogrammed device to divert transactions to another account. E-monétique, a specialist in payment solutions, has recorded a case where cybercriminals stole 750,000 euros in less than five months, distributed across several businesses. They often use stolen cards with their confidential codes to make a purchase, then request a refund on another payment method they control. LCL advises merchants to detect fraud by identifying several expensive purchases paid in quick succession with different cards. Up to 2024, more than 600 operators used a phishing kit called Magic Cat to compromise 884,000 credit cards worldwide, including around 9,000 in France, over seven months. These operators sent fake messages via SMS, iMessage, or RCS messages, imitating couriers like La Poste or Chronopost to bypass spam filters. They only displayed fake pages on mobile devices using 4G networks to avoid detection by antivirus software on computers. Thirteen million people clicked on these fraudulent links worldwide. French authorities had not opened any judicial investigations when this campaign was discussed. According to Cybermalveillance.gouv.fr, this underground economy led to a 170% increase in commercial fraud in 2025, driven by fraudulent payment sites and impersonated services. These networks also sell ready-to-use phishing kits and offer call center services. The government website refers to a growing industrialization of these scams. Card payment fraud represented 234.3 million euros in France in the first half of 2025, a 9.8% decrease year-on-year, according to the Observatoire de la sécurité des moyens de paiement of the Bank of France. A significant part of this decrease, according to the Bank of France, was due to the strong authentication required by the European regulation DSP2 for remote payments. This protection does not apply to in-store purchases, so data stolen during store payments can still occur. Merchants are advised never to let an unknown person manipulate their payment terminal, even if the caller claims it's an urgent update. They should verify the identity of any technician by calling their service provider directly on a known number, not the number provided by the caller. They should refuse to connect any third-party equipment to their network. If possible, they should separate the network of their terminal from the Wi-Fi they provide to customers to limit the consequences of an intrusion. They should avoid using captive portals from stores and hotels and instead share their connection from their phone. The National Agency for Information System Security provides these recommendations in its guide for small businesses and SMEs, published at the end of 2024. Merchants are advised to install software and system updates as soon as they are available, preferably enabling automatic downloads. They should choose passwords of at least fifteen characters for critical services, combining uppercase letters, lowercase letters, numbers, and special characters. They should enable multi-factor authentication whenever possible and use a certified password manager. They should require service providers to apply these updates through contracts and prefer providers labeled ExpertCyber. They should regularly check their bank statements and compare cash register receipts with summaries from their service provider each evening. They should always request a bank identity verification before processing any customer refund. They should train their staff to recognize warning signals, starting with unsolicited calls requesting remote access to terminals. As a supplement, they should apply a distinctive, easily identifiable mark on their payment terminals to quickly recognize any substituted device.