Subject: Re: Fw: PayFlow Account - Please read
From: "Joey Sheets" <[email-masked]>
To: "Mike" <[email-masked]>
Date: Tue, 13 Apr 2010 12:37:51 -0400

I locked down the Payflow side, but the manager side can not be really
locked down since our ip from comcast changes from time to time (dynamic)
and the guys in the office would then be locked out.

On Tue, Apr 13, 2010 at 12:30 PM, Mike <[email-masked]> wrote:

>  Where are we regarding any of this?
> Thank you,
> Michael Bishop
> Labor Law Poster Service
> Phone 877-321-4144
> Fax 888-442-4144
> [email-masked]
> ----- Original Message -----
> *From:* Vaughan, Janet <[email-masked]>
> *To:* Vaughan, Janet <[email-masked]>
> *Sent:* Tuesday, April 13, 2010 10:02 AM
> *Subject:* PayFlow Account - Please read
>
>  Good Morning,
>
>
>
> As fraud is becoming more prevalent, I wanted to take a moment to call this
> e-mail to your attention.  One of the easiest things that you or your IT
> department can do to prevent fraudsters from gaining access to your account
> is to lock down the IP addresses allowed to access the PayPal Manager.  This
> will help to ensure that the account is secured from a personal computer and
> an API perspective.
>
>
>
> With that in mind, I encourage you to take a moment to see if your IP
> addresses are locked down.  If you or your IT department is unsure, please
> reach out to me and I can help you to validate.  I am also attaching
> instructions on how to lock down the IP addresses in the manager account.
> The person attempting to do this will need administrative privileges.
>
>
>
> Please note that you are not required to take any action at all.  I am
> simply calling this to your attention.  I will be glad to assist in any way
> that I can.
>
>
>
> Thanks
>
> Janet
>
>
>
>
>
>
>
> *From:* PayPal [mailto:[email-masked]]
> *Sent:* Monday, April 12, 2010 4:16 PM
> *To:* Brooks, Monica
> *Subject:* Is your Payflow account being securely managed?
>
>
>
>
> Dear Jack Spratt,
>
> Did you know Payflow gives you the ability to secure your account and your
> transactions?  Make sure your account is protected by utilizing the tools
> available and following best practices.  Here are a few easy things you can
> do to prevent unauthorized access to your account and reduce the risk of
> fraudulent activity:
>
> Manage who has access to your account.
>
> ·    Never share login name and password.
>
> ·    Periodically change passwords based on your own internal controls.
> PayPal recommends changing your password every 30 days.
>
> ·    Change your password immediately if there is any indication your
> account credentials have been compromised.
>
> ·    Set up separate users on your account and set the roles to give the
> additional users access to specific functions to perform their job.
>
> ·    Limit the number of users with Administrative permissions to your
> account.  Members of the Admin group have complete control over your account
> and can perform all transactions via an API.
>
> ·    Create a separate user (with the appropriate permission) for your
> transaction processing and API credentials.  This can be used as a way to
> provide limited access to a 3rd party solution that may require API
> credentials for your account.  For example, if you do not need to perform
> credits via your website, create a Payflow user with the role of LIMITED.
>
> Set up IP restrictions for Manager access and transaction processing.
>
> ·    Prior to setting up IP restrictions check to make sure you do not
> have internal IP behind a proxy/router or that your hosting company does not
> use dynamic IP addresses. If you use a static IP or range of IPs, consider
> the following:
>
>    o Setting up IP restrictions so that only your IP/IP range can access
> Manager.
>
>    o Setting up IP restrictions so that only your IP/IP range can send
> transactions to Payflow.
>
> Set your Transaction Security Settings to restrict high risk transaction
> types if you don’t need them for your business model, such as:
>
> ·    Do not allow non-reference transactions; prevent credit transactions
> to credit cards that were never charged originally.
>
> ·    Do not allow credits to exceed the original transaction amount.
>
> ·    Limit the dollar amount of credits by setting a maximum allowed.
>
> Consider additional account protections such as:
>
> ·    Actively manage your Payflow account by logging in and reviewing
> activity on a regular basis to verify the number of transactions and types
> of transactions are in line with your normal business volume.
>
> ·    Encrypt your login and transaction credentials on your web server or
> within your application.
>
> ·    Create velocity checks to your processing to monitor transactions and
> IP addresses.
>
> ·    Utilize our Payflow Fraud Protections Services to ensure velocity
> checks are in place for your processing along with many other filters to
> help assist in preventing fraud.
>
> ·    Ensure your network is secure by performing regular network scans on
> your own servers or that include your web host if you use a 3rd party
> hosting company.
>
> ·    Verify the servers your Payflow credentials reside on are up-to-date
> with all security patches and have proper firewalls and procedures in place
> to monitor activity on your server.
>
> ·    Review logs for any suspicious activity or modifications.
>
> If you have any questions on utilizing any of the best practice measures
> described above, please contact us at [email-masked] or
> 1-888-883-9770.
>
> Sincerely,
>
> Payflow Support
>
> © 2010 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First
> St., San Jose, CA 95131.
>
>
>