Virtual terminal security guidance
How can a virtual terminal be secured?
A virtual terminal can be secured by protecting user accounts, limiting access by job role, keeping work devices and networks maintained, training staff to recognize phishing, and reviewing activity for unexpected changes. The provider's current security controls and support instructions should guide the exact setup.
Security is an ongoing business process rather than a one-time setting. A useful approach combines account controls, careful payment-entry habits, device hygiene, staff procedures, and a documented response path.
Access control
Give each user an accountable login
Start with separate user accounts wherever the virtual terminal supports them. Shared credentials make it harder to remove access when responsibilities change and harder to understand who performed an action. Assign only the permissions a person needs, reserve administrative access for a small number of authorized users, and remove access promptly when an employee or contractor leaves the role.
Enable multifactor authentication when the provider offers it. NIST explains that MFA adds another identity check beyond a password and recommends enabling it on accounts that offer it, especially for sensitive applications. Prefer the strongest practical option shown by the provider, keep recovery methods current, and never ask staff to share passwords or one-time codes.
For a related staffing decision, review whether multiple employees should use one virtual terminal.
Workstation safeguards
Use maintained business devices and trusted connections
A secure login cannot compensate for an unmanaged or unattended device.
Keep software current
Install operating-system, browser, security, and provider updates promptly. CISA highlights timely software updates as a basic way to address known weaknesses. Use supported browser and operating-system versions, and enable automatic updates where they fit the business's change process.
Control the workspace
Use business-managed computers where practical, lock screens when stepping away, and keep the virtual terminal out of public view. Avoid leaving an authenticated session open on a shared counter, public computer, or personally owned device that the business does not manage.
Separate guest access
Protect the business network and do not place payment workstations on an open guest network. The FTC advises businesses to secure routers, change default credentials, use current wireless encryption, and separate guest access from the primary business network.
Safe operation
Reduce sensitive data handling during payment entry
Enter payment information only through the authenticated virtual terminal or another provider-approved workflow. Do not ask a customer to send card numbers, security codes, passwords, bank credentials, or secret API keys through ordinary email, text, chat, or a general website form. Do not copy payment details into notes, spreadsheets, screenshots, support tickets, or shared documents for convenience.
Before entering a payment, confirm the customer, amount, purpose, and authorized transaction details using the business's established procedure. Afterward, retain only the non-sensitive references needed for ordinary operations, such as an order number or provider transaction identifier. Follow the provider's current instructions for receipts, saved payment methods, refunds, and record access rather than inventing a side process.
Human defenses
Train staff to resist account takeover
CISA identifies phishing recognition, strong unique passwords, MFA, and software updates as four practical online-safety actions. Apply those habits to every person who can reach the virtual terminal. Staff should pause when a message creates urgency, requests a login or verification code, changes payment instructions, or links to an unfamiliar sign-in page.
Teach users to reach the virtual terminal through a saved official address or the provider's verified site, not through an unexpected message. Password-manager use can help staff create and store unique credentials without reusing them. Establish a clear internal contact for suspicious messages, unexpected MFA prompts, unusual transactions, and lost or stolen devices.
Explore more operational controls through the fraud prevention and security FAQ and review what a virtual terminal is before assigning access.
Monitoring and response
Review activity and prepare for suspicious events
Review access regularly
Periodically compare active users and permissions with current job responsibilities. Check available login history, transaction activity, device records, and alert settings. Investigate unfamiliar changes through the provider's official support path.
Respond through verified channels
If compromise is suspected, use a known clean device to contact the provider through its official website or authenticated portal. Follow its steps for securing the account, reviewing activity, and preserving useful non-sensitive references.
Document a simple playbook
Name the internal decision maker, provider contact route, device owner, and person responsible for reviewing transactions. Keep credentials and full payment data out of the playbook. Test that staff can find it before an incident occurs.
The FTC recommends an incident response plan as part of normal business security. The exact response will depend on what happened and which systems are involved, so escalate promptly to the responsible provider and qualified security advisers rather than guessing.
Practical questions
Common virtual terminal security questions
Should employees share one virtual terminal password?
Use separate named accounts when available. Individual access supports permission control, offboarding, and clearer activity review. If the provider lacks that feature, ask it for the supported secure workflow.
Is MFA enough by itself?
No. MFA is an important account safeguard, but businesses should also maintain devices, limit permissions, use trusted networks, train users, and monitor activity.
Can card details be saved outside the virtual terminal?
Do not create informal copies in email, chat, notes, spreadsheets, screenshots, or general forms. Use only provider-approved payment and saved-payment workflows, and follow the provider's current instructions.
Related guidance
Connect security with virtual terminal operations
Next step
Run a focused virtual terminal access review
List current users, confirm each person's role, enable the strongest practical MFA option, remove obsolete access, update the responsible devices, and document the official support route. Use non-sensitive test information when checking the workflow.
To learn more about how TSYS can help improve the way your organization accepts payments, markets to new customers, or manages its HR responsibilities, get in touch by calling 585-981-8463 to get started.
CONTACT US