Subject: Fw: Is your Payflow account being securely managed?
From: "Customer Service" <[email-masked]>
To: "Joey Sheets" <[email-masked]>
Date: Tue, 13 Apr 2010 07:59:16 -0400

Maybe this would be helpful to you?
Thank you,
Michael Bishop
Labor Law Poster Service
Phone 877-321-4144
Fax 888-442-4144
[email-masked] 
----- Original Message ----- 
From: PayPal 
To: [email-masked] 
Sent: Monday, April 12, 2010 5:24 PM
Subject: Is your Payflow account being securely managed?

     
      Dear Michael Bishop,

      Did you know Payflow gives you the ability to secure your account and your transactions?  Make sure your account is protected by utilizing the tools available and following best practices.  Here are a few easy things you can do to prevent unauthorized access to your account and reduce the risk of fraudulent activity:

      Manage who has access to your account.

      ·    Never share login name and password.

      ·    Periodically change passwords based on your own internal controls.  PayPal recommends changing your password every 30 days.

      ·    Change your password immediately if there is any indication your account credentials have been compromised.

      ·    Set up separate users on your account and set the roles to give the additional users access to specific functions to perform their job.

      ·    Limit the number of users with Administrative permissions to your account.  Members of the Admin group have complete control over your account and can perform all transactions via an API.

      ·    Create a separate user (with the appropriate permission) for your transaction processing and API credentials.  This can be used as a way to provide limited access to a 3rd party solution that may require API credentials for your account.  For example, if you do not need to perform credits via your website, create a Payflow user with the role of LIMITED.

      Set up IP restrictions for Manager access and transaction processing.

      ·    Prior to setting up IP restrictions check to make sure you do not have internal IP behind a proxy/router or that your hosting company does not use dynamic IP addresses. If you use a static IP or range of IPs, consider the following:

         o Setting up IP restrictions so that only your IP/IP range can access Manager.

         o Setting up IP restrictions so that only your IP/IP range can send transactions to Payflow.

      Set your Transaction Security Settings to restrict high risk transaction types if you don’t need them for your business model, such as:

      ·    Do not allow non-reference transactions; prevent credit transactions to credit cards that were never charged originally.

      ·    Do not allow credits to exceed the original transaction amount.

      ·    Limit the dollar amount of credits by setting a maximum allowed.

      Consider additional account protections such as:

      ·    Actively manage your Payflow account by logging in and reviewing activity on a regular basis to verify the number of transactions and types of transactions are in line with your normal business volume.

      ·    Encrypt your login and transaction credentials on your web server or within your application.

      ·    Create velocity checks to your processing to monitor transactions and IP addresses.

      ·    Utilize our Payflow Fraud Protections Services to ensure velocity checks are in place for your processing along with many other filters to help assist in preventing fraud.

      ·    Ensure your network is secure by performing regular network scans on your own servers or that include your web host if you use a 3rd party hosting company.  

      ·    Verify the servers your Payflow credentials reside on are up-to-date with all security patches and have proper firewalls and procedures in place to monitor activity on your server.

      ·    Review logs for any suspicious activity or modifications.

      If you have any questions on utilizing any of the best practice measures described above, please contact us at [email-masked] or 1-888-883-9770.

      Sincerely,

      Payflow Support

      © 2010 PayPal Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.