I wonder what is available in the settings interface? For example, is there some gateway address that could be changed to a MITM transparent proxy? They act like this is no big deal, but 9/10 of these machines has the same password!
I.E. some protocols I've worked with have had all sensitive data protected by ANSI X9.24 Appendix 1 (I think...) derived keys, or keys derived by various other standard means, such that being able to read the data stream is pretty irrelevant.
> Presumably ... there is some sort of encryption going on.
Well, all the security systems have to be audited and signed-off by third-party testing labs approved by the payment card industry body (PCI) so your cynicism should be unwarranted.
But then I've seen code that got through those labs that I would be thoroughly ashamed of, so who knows really...