POS and processor logins: password habits that protect you

A cashier who quit three months ago still knows the manager's POS code. The processor portal password is the store's name plus the year, and it's on a sticky note under the register. That's how many small stores run, and it's exactly how accounts get misused. POS password security comes down to a few habits: unique logins, strong passwords, a second sign-in step where it's offered, and removing access the day someone leaves.

None of this is complicated. It just has to become routine.

Why do logins matter so much?

Your POS controls sales, refunds, voids, and discounts. Your processor portal shows deposits, statements, and sometimes lets you issue refunds or change bank details.

If the wrong person gets into either one, they can move money out of your business or hide their tracks. That person might be a former employee, a current one, or someone outside who guessed or stole a password.

Weak or shared passwords make it easy. Unique, strong ones make it hard.

It also affects your records. When everyone shares one login, you can't tell who did what. When each person has their own, every action has a name.

What makes a good password habit?

The basics, straight up.

Every person gets their own login. No shared cashier accounts.

Passwords are long. A phrase of several unrelated words is easier to remember and harder to guess than a short mix of symbols.

No store names, addresses, birthdays, or phone numbers.

Different passwords for different systems. Your POS, processor portal, email, and bank should not share a password.

Change default passwords on anything new. Routers, cameras, and some devices come with factory passwords that are publicly known.

Use a password manager if you have many accounts. It stores passwords securely so you don't need sticky notes.

The CISA Secure Our World program has plain guidance on strong passwords and multi-factor sign-in for small businesses.

What is multi-factor sign-in, and should you use it?

Multi-factor authentication means signing in with a password plus something else, usually a code sent to your phone or generated by an app. Even if someone steals your password, they can't get in without the second step.

Turn it on wherever it's offered, especially for your processor portal, business email, and bank. Those are the accounts where a break-in costs the most.

Yes, it adds a few seconds. That's a small price for keeping someone out of your deposits.

If your POS or portal doesn't offer it, ask your provider whether it's available or planned.

What happens when someone leaves?

This is where most stores slip. An employee leaves on a Friday, and their login still works on Monday.

Make offboarding a checklist.

1. Turn off their POS login the day they leave.
2. Change any shared codes they knew, like alarm codes or manager override codes.
3. Remove their access to the processor portal, email, and any vendor accounts.
4. Collect keys, fobs, and store devices.
5. Review recent refunds and voids under their login.

It's not personal. It's standard practice, and good employees understand.

For more on protecting business accounts, the FTC offers data security guidance for businesses. If you need help managing access to your NRS Pay account, contact the NRS Pay team. NRS Pay integrates with the NRS POS, and your POS provider can explain user settings on that side.

If all of this feels like a lot, start with two steps this week: give every cashier their own login, and turn on multi-factor sign-in for your processor portal. Those two changes close the most common gaps. The rest can follow over the next month as you work through your accounts one at a time.