We have identified a potential vulnerability that will soon be addressed with some process and code changes. In the meantime, we need to reinforce our internal policies to all teams that work with merchants in the Payment Portal.

Resetting Password

If a merchant reaches out asking to have their Payment Portal password reset, we should direct them to the Login page to use the ‘Forgot Password’ link. That will email the user with a password reset link they can use to reset their password. This is the most secure method of resetting a password and should always be the option we suggest.