BMA International

Fraud is a common problem in the retail sector, particularly within large chains with hundreds of locations and tens of thousands of employees. BMA’s retail stores were no exception. Following an internal audit, security of point-of-sale (POS) terminals in retail outlets were identified as a serious concern, particularly the misuse of floor supervisors’ credentials to access terminals and modify or cancel transactions.

The problem persisted even after BMA switched from passwords to a smart card-based authentication system. The most common issues involved supervisors leaving smart cards with cashiers to use in their absence and failing to return the cards when a separation from an employer occurs — a frequent occurrence as many of BMA’s retail employees are expatriates who often return to their home countries.

Fraudulent use of the smart card was also a common problem. Once a sale was completed and the customer had left the store with their purchased items, the smart card could be used to improperly access the system so the cashier could void the transaction and pocket the “refund,” resulting in both monetary and inventory losses. “BMA’s internal auditors were concerned with the lack of control over the cards and the potential for fraudulent transactions due to their mishandling. They observed clear gaps in security and authentication practices that led directly to fraud and revenue leakage, resulting in the Internal Audit Committee recommending to the BMA Board of Directors that action be taken to plug the security holes by tightening the authentication process,” said Nainan M. Kurian, CEO of BMA International.

The decision was made to transition authentication to a biometric-based system that would provide the required security at a competitive price which aligned with the aesthetics of the retail stores. The system also needed to be compatible with the Oracle Retail Xstore Office Cloud Service, which BMA International was adopting across its brands.