By Cody Carter | Platinum Payment Processing
A front-desk employee needs to collect a payment. A manager may need to review a refund. Your bookkeeper needs reports. Those jobs do not automatically require the same access to your payment system.
Before adding another login—or sharing an owner’s password—review what each person actually needs to do. A short permissions review can uncover questions that a processing-rate comparison alone will miss.
Start with people and tasks
List everyone who uses your payment tools, including staff, outside bookkeepers and technology vendors. For each person, write down the job they need to complete and who approves their access.
Then ask your provider to show which tasks can be separated. Examples to review include taking payments, issuing refunds, changing prices, exporting reports, changing account settings and adding users. Do not assume every system supports the same controls.
PCI SSC’s small-business guidance recommends limiting access to business needs and using individual identities instead of shared user IDs and passwords. PCI SSC: Keep Hackers Out.
Avoid making the owner login the staff login
Sharing a powerful login makes it harder to establish who performed an action. Ask how your selected system identifies individual users and records their activity.
A useful demonstration should answer practical questions: Can an employee complete an ordinary sale with their own access? What happens when that employee tries a manager-only task? Who can restore access when the authorized owner is unavailable?
Use approved recovery procedures. Do not solve a forgotten password by distributing another person’s credentials.
Review refund authority separately
Decide who should approve a refund, who may enter it, and how the business reviews completed refunds. Ask whether your system can support that division of responsibility.
This complements a written refund process; it does not replace one. Platinum’s customer refund checklist covers the original transaction, funding and completion checks.
If a system cannot enforce the approval step you want, decide whether a documented manual review is workable before buying an upgrade or changing providers.
Ask about remote and outside access
An outside bookkeeper may need reporting access while a support technician needs help with a specific issue. Ask how those needs can be handled without giving both people broad, permanent control.
Confirm how remote access is authorized, protected, logged and ended. Use multifactor authentication where supported and required for your environment. Have the provider explain the applicable requirements rather than treating a generic checklist as a compliance assessment.
PCI SSC describes least privilege as giving users only the access required for their work. PCI SSC access-control discussion.
Make access changes part of staff changes
When someone changes roles or leaves, promptly review their payment-system access and connected tools. Assign an owner to that process. Confirm that the former access has actually ended rather than assuming a personnel change automatically updates every system.
Use a recurring review to catch accounts that no longer serve a business purpose. Keep an internal record of who approved access and when it was last checked.
Ask for a demonstration before deciding
Use your own workflow in the demonstration: an employee takes a payment, a manager handles an approved refund, and a bookkeeper reviews the relevant report. Ask what each person can see, what they can change and what activity history is available.
Features, subscriptions and device support vary. Square, for example, documents separate team permissions and point-of-sale passcode features; that does not establish availability or pricing in a proposed Platinum setup. Square’s team-permissions documentation.
Have the provider identify any extra costs and limitations in writing. Security settings deserve the same scrutiny as equipment, software compatibility and processing costs.
Review the complete setup with Platinum
Platinum’s free merchant analysis is a starting point for reviewing your current processing costs and discussing the payment tasks your team needs to perform.
Tell us which software you use and which staff roles need access. We can include those requirements in the discussion before recommending a change. Do not send passwords, authentication codes or customer card information.
This is an operational checklist, not a PCI compliance certification. Your applicable security obligations depend on your environment and should be confirmed with the appropriate provider or qualified adviser.
