When you see point of sale software in the news, it’s usually because the terminal has been compromised and is now stealing payment details used in the device. Insecure stores, whether compromised as part of an inside job or a phishing attack, are a big problem for both buyers and the store itself when the attack comes to light.
This time around, it’s a little bit different. The point of sale software here allegedly emerged during the pandemic and is designed to be an “Electronic Sales Suppression Tool”. It doesn’t steal payment details from shoppers. Rather, it enables the shop owner to potentially get up to a bit of tax dodging. The continued growth of these tools has resulted in the arrest of five individuals which tax authorities allege to be involved in the design and sale of said software.
Taxing times for scammers
The raids in Australia were spearheaded by the Australian Tax Office, alongside simultaneous raids undertaken in the US and UK. So-called Electronic Sales Suppression Tools (ESST) were outlawed in Australia back in 2018. From ATO Deputy Commissioner John Ford:
These dodgy sales suppression tools allow retailers to keep a separate set of books and launder the money in one transaction. They conceal and transfer this income anonymously, sometimes offshore.
How do these tools work?
ESSTs are designed to manipulate sales data in a way which allows the business to reduce the value of transactions. When this happens over a period of time and not all sales are being recorded properly, the business is making money but it is also shirking responsibility for paying its tax correctly.
This became a particular problem during the COVID-19 outbreak, where businesses in the UK were found to be committing specific kinds of pandemic fraud. The UK ran a Coronavirus Job Retention Scheme (CJRS), where employers could receive financial assistance in situations where employees were unable to work or the business had to reduce its capacity.
By using ESSTs, you could potentially show that your sales were down (when they’d actually been tampered with) and then claim against the CJRS scheme.
Targeting the suppliers
By and large, tax agencies and governments are focusing on the sellers, the coders, and the distributors of the tools. Having said that, businesses currently using ESST are being urged to notify the tax office before the tax office catches them in the act where penalties are likely to be more severe. From the ATO statement:
The ATO strongly encouraged businesses using ESST to come forward voluntarily rather than hope they won’t be discovered by ATO investigators.
Businesses that come forward voluntarily may be provided with an opportunity to receive a reduction in penalties. Information about how to do this is on the ATO website.
Businesses that have used ESS tools or software will need to review their past tax returns and activity statements to amend or correct them. They may also wish to discuss next steps with their registered tax professional.
According to The Register, 35 locations have been raided by Australian authorities in connection with ESST activities. Meanwhile Dutch tax agencies are branching out into exploring cryptocurrency and virtual assets. The slow shift away from cash to digital payments and processing in the post-pandemic world has encouraged a new arena of tax evasion and money laundering for both tax authority and scammer. It’ll be interesting to see who gains the upper hand. For now, the advantage seems to be with the tax agencies slowly closing the net on anyone looking to turn a dubious profit.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.