How should mobile payment devices be managed?

Manage mobile payment devices as business assets, not as ordinary phones or tablets. Give each device an owner, record where it belongs, limit who can use administrative functions, keep its approved software current, monitor its condition, and prepare a response for loss, theft, or suspicious activity.

The exact controls depend on the payment provider, device type, operating system, and whether the hardware is company-owned or personally owned. A documented process helps a business apply the right provider instructions without assuming that one platform's settings work everywhere.

Start with ownership and an accurate inventory

Create an asset record before a phone, tablet, reader, or mobile terminal enters service. Record the device name, model, serial number, assigned location, responsible manager, payment application, operating-system version, accessories, and date placed into use. Avoid putting passwords, recovery codes, or secret keys in the inventory.

NIST's current enterprise mobile-device guidance covers deployment, use, centralized management, monitoring, and disposal across the device lifecycle. That lifecycle approach is useful for payment operations because a device can change staff, location, software version, or service status long before it is physically worn out.

Use a consistent naming convention so staff can match the physical device to its dashboard record. Review the related guidance on inventorying payment terminals for a practical asset-record structure.

Build a controlled setup process

Assign the device

Connect each device to the correct business account and operating location using the provider's documented workflow. Stripe, for example, groups registered readers by location, while Square device codes can associate a device with a business location. These are provider-specific examples, not universal setup instructions.

Limit access

Give each employee only the access needed for the role. Prefer individual credentials or provider-supported staff passcodes over shared owner credentials, and protect administrative actions with stronger permissions.

Approve software

Install payment apps and updates only from the provider or an approved app channel. Remove unrelated apps from company-owned checkout devices when they are not needed for business operations.

Verify before service

Confirm the correct location, network, receipt identity, staff access, and dashboard visibility before normal customer use. Follow the provider's approved test process without entering real card details into notes or general forms.

Use practical safeguards during daily operation

Screen and account access: Require a device lock and provider-supported authentication. Do not leave an owner or administrator session open for general staff.
Physical control: Store devices in an assigned place, check them at opening and closing, and investigate an unexpected serial number, seal change, cable, attachment, or screen prompt.
Network discipline: Use a business-approved connection and avoid unknown public Wi-Fi. Do not bypass security settings simply to restore connectivity.
Updates: Track operating-system, payment-app, and reader-software status. Test significant changes on a limited device when the provider supports a staged rollout.
Charging and care: Use approved accessories, keep devices away from heat and liquids, and replace damaged batteries, cables, or housings through an authorized support path.
Shift handoff: Confirm that the correct device is returned, signed out or secured as required, and ready for the next authorized user.

For broader troubleshooting context, see what to check when a terminal cannot connect. Connectivity troubleshooting should never require staff to weaken account or network protections.

Monitor the fleet and review exceptions

Choose a regular review interval based on the number of devices and how often they move. Compare the physical inventory with the provider dashboard, confirm assigned locations and users, check update status, and remove devices that should no longer have access.

Provider dashboards can expose different information. Stripe documents reader status and operational details in its Readers list, while Square documents viewing device information such as location, connectivity, and application use. Confirm what your selected platform actually records and who is authorized to see or change it.

Document unusual events such as repeated sign-in failures, unexpected configuration changes, a missing device, unrecognized accessories, or a device appearing under the wrong location. Escalate those events through the payment provider's verified support channel and the business's internal incident process.

Prepare for a lost, stolen, or damaged device

Remove it from service. If the device is still present but damaged or behaving unexpectedly, stop using it and preserve the details needed for support.
Notify the responsible manager. Record when and where the device was last seen, who used it, and its asset identifier without collecting unnecessary personal information.
Use approved remote controls. If supported and already configured, an administrator may lock, disable, or wipe a company-owned device through the organization's management service. Google documents remote lock and wipe capabilities for fully managed Android devices, but availability varies by device, version, ownership model, and management product.
Contact the payment provider. Ask the provider to review the payment-device registration, account access, and any additional steps appropriate for that deployment.
Review activity and replace carefully. Check relevant dashboard activity, then enroll a replacement as a new or reassigned asset using the provider's documented process.

Do not improvise a factory reset or reuse another device's credentials unless the responsible provider or device-management procedure specifically calls for it.

Retire or reassign devices deliberately

Before a device leaves a location or changes users, finish pending provider-directed steps, remove or reassign account access, and update the inventory. If the device is being retired, follow approved erasure and disposal instructions appropriate to its ownership and management state. A physical handoff alone does not remove dashboard access or stored configuration.

Keep a record of the date, approver, action taken, and final disposition. For aging equipment, review what happens when a terminal reaches end of support before deciding whether to retain, replace, return, or dispose of it.

A simple management checklist

Maintain one current asset record for every payment device.
Assign each device to the correct account, location, and responsible person.
Use individual access and least-privilege permissions where supported.
Keep approved operating-system, app, and reader updates current.
Inspect devices and reconcile them with dashboard records regularly.
Document loss, theft, damage, and suspicious changes immediately.
Remove access and update records before reassignment or retirement.

The mobile payments and contactless FAQ hub provides additional guidance for planning mobile acceptance workflows.

Define the workflow before adding devices

List the device types, business locations, staff roles, networks, and management tools involved. Then confirm the supported enrollment, permissions, monitoring, and incident steps with the selected payment provider before placing equipment into service.

Discuss mobile payment requirements

Share only business contact details and a high-level description of the workflow. Do not submit cardholder data, passwords, bank credentials, complete account numbers, security codes, device-management recovery keys, or secret API keys through a general form.

To learn more about how TSYS can help improve the way your organization accepts payments, markets to new customers, or manages its HR responsibilities, get in touch by calling 585-981-8463 to get started.