Victorian authorities seized more than 3,000 counterfeit tap-to-pay overlays and blank EFTPOS shells from a Brunswick waterfront warehouse on Sunday night, disrupting a supply chain police believe fed card-skimming crews working regional festivals. Two men were arrested and charged with possessing equipment to make false instruments; investigators are tracing Bluetooth modules found in the shipment.
How the overlays work
Skimmers ship ultra-thin plastic faces that fit over legitimate terminals, capturing card data while shoppers tap phones or wallets. Modern variants pair with tiny radios that relay PIN pads to accomplices off-site. Detectives from the cybercrime squad said the Brunswick cache included moulds sized for portable units common at food-truck rows and craft markets.
The raid followed a spike in disputed transactions reported by banks after the Bendigo Agricultural Show and several Gippsland music weekends. Merchants often discover tampering only when chargebacks cluster days later.
Merchant and bank response
Australian Payments Network urged stallholders to inspect terminals for glue residue and mismatched screws before each trading day. Major acquirers are pushing firmware that disables external overlays when internal seals break, but older devices remain in circulation.
Consumer groups reminded shoppers to enable transaction notifications and avoid tapping when the terminal looks bulky or misaligned. Liability rules generally protect consumers for unauthorised tap payments, yet disputes can take weeks to resolve during peak retail seasons.
Cross-border links
Investigators are working with Australian Border Force to determine whether components arrived via air cargo mislabelled as phone accessories. Similar overlays were intercepted in New South Wales last month, suggesting a national distribution list rather than a one-off cache.
For festival organisers, the bust is a prompt to vet cashless vendors and provide secured power boards. For policymakers, it revives calls to accelerate terminal refresh subsidies for small businesses still running decade-old EFTPOS hardware.
Prevention checklist for vendors
Acquirers are mailing tamper-evident stickers to market traders who passed compliance checks this year. Stallholders should photograph serial numbers daily and refuse third-party “maintenance” visits that arrive without written authorisation from their bank.
Consumer advocates urged the federal government to fund terminal upgrades for charities that cannot afford new hardware before the summer festival circuit. Until then, cash remains the fallback for the smallest operators—even as society trends cashless.
Prosecution pathway
Police said briefs of evidence would be prepared within six weeks, with forensic examination of Bluetooth modules prioritised. Legal aid lawyers noted that possession charges differ from fraud prosecutions requiring proof of actual card data theft; investigators must link devices to live skimming incidents.