How should old credit card terminals be disposed of?

Start by controlling and identifying the device

Keep a retired terminal in the same controlled environment used for active payment equipment until its disposition is documented. Record the model, serial number, asset tag, location, date removed from service, and the person responsible for the handoff. If the device is connected to a point-of-sale system, gateway, cellular plan, or device-management portal, note those relationships so the appropriate administrator can remove or deactivate the correct record.

Do not dismantle, drill, crush, or deliberately trigger tamper features as a do-it-yourself sanitization method. A payment terminal is specialized equipment, and opening it may create battery, electrical, environmental, or security risks. Keep accessories such as power supplies, docks, cables, and removable batteries with the inventory record until the recipient confirms what should be returned or recycled.

Sanitize data without assuming a factory reset is enough

Terminal models differ in what they store and which reset functions a merchant can access. A screen option labeled reset, delete, or factory defaults may remove visible settings without proving that every relevant storage area or credential has been addressed. Do not claim successful sanitization based only on the device returning to a welcome screen.

Ask the responsible provider, manufacturer, or qualified asset-disposition vendor for the approved sanitization or decommissioning method for the exact hardware and software version. NIST describes media sanitization as making access to target data infeasible for a defined level of effort and recommends an organization-wide, risk-based process for reuse and disposal. For a merchant, the practical lesson is to use a documented method, assign responsibility, and retain evidence of completion rather than improvising.

Remove external asset labels, merchant stickers, location names, support numbers, Wi-Fi labels, employee notes, and other business identifiers after recording what the asset log needs. Do not place cardholder data, passwords, complete account numbers, bank credentials, secret keys, or security codes into a disposal log.

Use a simple retirement record

A concise disposition record helps close the loop between the physical terminal, payment operations, and asset management. Include the device identifier, prior location, removal date, reason for retirement, ownership or return confirmation, sanitization method and responsible party, destination, shipment or pickup evidence, recycler certificate when provided, and final completion date.

Also confirm that the retired unit no longer appears as active where your authorized administrators manage devices. That may involve an internal equipment list, help-desk record, mobile-data account, or provider portal. Do not assume that recycling the physical device automatically updates every service or administrative system connected with it.