MyST User Guide Published: 23 April 2018

Transcription

1 This document outlines how to use MyST, our transaction management tool. Here you will find a breakdown of the various functions available and instructions on how to use them. Published: 23 April

2 Table of Contents 1 Getting started Introduction Sign in MyST home page Transaction quick view Sign out Transactions Transaction search Reporting Virtual terminal ST PayMe Users User details User settings Add a new username Roles Sites Site details File manager Rule manager Subscriptions Introduction Viewing the parent Authorisation Viewing the Subscription Update a Subscription Further Information and Support Secure Trading Support Secure Trading Sales Useful Documents Frequently Asked Questions Best Practices Secure Trading Limited April 2018 Page 2 / 70

3 1 Getting started 1.1 Introduction MyST is a secure interface providing online real-time access to your payment history. The status of every transaction can be tracked, allowing your Secure Trading account to be managed more effectively. Using MyST you can: View, refund, repeat or reverse your transactions in one place Set permission levels for different types of users Specify the settlement date of your processed transactions Change the amount of a transaction Download transaction details and export into your accounting software Manage payment pages using our secure servers Pay your Secure Trading invoices easily via credit or debit card Authorise payments that cannot be processed online for example, telephone orders and orders by post via your Virtual Terminal for MOTO transactions When you have signed up for an account with Secure Trading, you will be issued with a MyST login comprising a username (a valid address) and password. You will be advised of your sitereference. A sitereference is a unique code that identifies your account in our system. To access all MyST features, Secure Trading recommends enabling JavaScript in your web browser when using MyST. If you currently have JavaScript disabled, you will receive a warning message when you sign in to MyST. Secure Trading Limited April 2018 Page 3 / 70

4 1.2 Sign in Before you can use MyST you must first securely sign in. Either: Navigate to Or navigate to the Secure Trading website ( and click MYST LOGIN in the top right. The first page you will see when you access MyST is the sign in page, as shown below. Enter your username and password (as supplied by Secure Trading) in the boxes provided and click the Sign in button. If the username and password do not match, then you will receive an Invalid username/password error message and you can try signing in again. If you continue to enter invalid details, you will be presented with a recaptcha prompt, which we use to protect against potential abuse of the sign-in page. Please note passwords are case sensitive. If you experience problems and are unable to sign into MyST, please contact our Support team. Contact details can be found in section 6. Secure Trading Limited April 2018 Page 4 / 70

5 1.2.1 Two-step verification Two-step verification provides an additional layer of security to protect your account from unauthorised access, by prompting for an access code to verify your identity at sign in If not enabled on your MyST user account If not enabled, you may be prompted to set up two-step verification by your administrator when signing into your MyST user account. We recommend that you follow the instructions displayed on screen to do so, as configuration only takes a few minutes and is a simple way to apply an additional layer of security to your account. You can also opt-in to using two-step verification at any time. See section for further information If enabled on your MyST user account If two-step verification has been enabled on your MyST user account, you will be prompted for an access code to complete the sign in process. This is retrieved by using an authenticator app. Note: The process of retrieving the code will be the same as when you configured twostep verification during the setup process (see section ) Password expiration We recommend that you regularly update your password to better protect your account against unauthorised access. If you have not changed your password for a long time, we will prompt you to update your password before completing the sign in process. Note: You must ensure your password meets our password policy (see section ). Secure Trading Limited April 2018 Page 5 / 70

6 1.3 MyST home page Once you have successfully completed the sign in process, the first page you will see is your home page. From here you can access all the other areas of the system by selecting the required link from the left side menu. Help is available throughout the MyST system by clicking the Help link in the left side menu Header information For security purposes, we will always display the IP address of the last device to sign into your account along the top of the page, along with the time that this occurred. You can compare this to the Current IP field, which is also shown. If these two IP values differ, this suggests that the last successful sign in occurred on a different device to the one you are currently using, but please note that your IP can vary when signing in remotely using a cellular network, or when securing your connection using a VPN. If you experience any problems using MyST please contact our Support team contact details can be found in section 6.1. If possible, quote the reference number that can be seen at the bottom of the page e.g. M Secure Trading Limited April 2018 Page 6 / 70

7 1.4 Transaction quick view After signing into MyST, you can view details of a transaction by inputting the transaction reference in the quick view box in the left side menu and clicking magnifying glass (or pressing the return key). You must have the complete transaction reference (inputted in the correct format, e.g ) and also ensure you have access to view the transaction. Once you have submitted the transaction reference, you will be displayed the transaction on the Single Transaction View page (as shown below). For further information, please refer to section 2.1.5). Secure Trading Limited April 2018 Page 7 / 70

8 1.5 Sign out In the interest of security, it is important to sign out of MyST after you have finished administrating your account. To sign out of MyST, click on the Sign out button in the top-right of the page and select OK, when asked for confirmation. You will be returned to the sign in page and will have been successfully signed out of MyST. Secure Trading Limited April 2018 Page 8 / 70

9 2 Transactions 2.1 Transaction search The Transaction search page allows you to view and manage your transactions. This section of the document covers how to use the Transaction search page, including: Searching for a transaction How to perform a search for a transaction, including advanced search and viewing options. Search Results How the search results are displayed on screen and how to sort them. Single Transaction View The Single Transaction View allows you to view all details for a single transaction, including viewing all related tr ansactions. Actions available How to re-authorise, refund or update a transaction Searching for a transaction Basic search Step 1: Select a Sitereference The first step of performing a search is selecting a sitereference(s). Selecting ALL automatically selects all sitereferences available to your account. Step 2: Setting the date range and stored search You can optionally select one of the Stored searches which will set the filters and fields for you (see section for further information). A date range must be specified for the search (see below). By default, the date range will be set for all transactions for the current day. Date type determines whether to search on the authorisation date or settlement date. Step 3: Press Search Once you have configured the sitereferences and date ranges, press the Search button. The search results can be displayed on screen or CSV by changing the Output type. Secure Trading Limited April 2018 Page 9 / 70

10 Search Options You can make your search more specific and add/remove fields that are returned in the results. Please note that the sitereference and date ranges must be set for each search. Search Criteria Setting the Search Criteria allows you to be more specific with your search. By default, the field values are blank (they are optional). When left empty, all details are searched for and no constraint is placed on the search. The Transaction reference must match the full transaction reference; no partial matches are returned. A unique transaction reference is generated by Secure Trading for each request. The Card number field must match the full card number used. Spaces can be included and will not affect the search, so both and will return the same result. Please note that to search on the card number, you must be in possession of the whole card number. Secure Trading Limited April 2018 Page 10 / 70

11 Other fields under the Search Criteria tab allow for full and partial matches. Full Match If you select is from the dropdown next to a field name, this allows you to search for requests that match the specified criteria exactly. Partial Match If you select is like from the dropdown next to a field name, you can include wildcards in your search to perform more advanced queries. Please note: Wildcards cannot be included in the first 5 characters of a search. Supported wildcards Usage % The percentage symbol can be used as a substitute for zero or more characters. For example, ABCDE% in the Order reference search box would return the following results: _ The underscore character can be used as a substitute for a single character. For example, 123ABC_56 in the Order reference search box would return the following results: Please note that you can escape wildcards by preceding them with a backslash \ character. e.g. Searching for order reference 123ABC\_56 would only return a request with order reference 123ABC_56 No match If you select is not from the dropdown next to a field name, this allows you to exclude requests that match the specified criteria exactly. Secure Trading Limited April 2018 Page 11 / 70

12 Filters Filter your search criteria using the checkboxes displayed under the Filters tab. For example, selecting USD in the Currencies field will return only transactions that were processed in USD. Secure Trading Limited April 2018 Page 12 / 70

13 Fields The Fields tab allows you to specify the fields that are returned by the search results. Please note the options you have selected will be retained on screen after the search is performed, allowing you to modify the chosen options and search again. Expanding boxes When you move your cursor over the boxes shown under the Filters and Fields tabs, they expand to show more options. This is to simplify the process of selecting options from large lists. After selecting the desired options, move your cursor away from the expanded box, and it will reduce to normal size. Secure Trading Limited April 2018 Page 13 / 70

14 2.1.2 Search Results If you have selected the Output as On Screen, the search results are displayed below the search options in the Search Results tab. Status keys are displayed in the Status Information tab and contain explanations for the different values returned by the search. Refer to section for further information Navigating the Results - Pagination To change the number of transactions displayed per page in the results, select the drop down on the top-left corner of the search results. Use the buttons at the bottom of the results to navigate between pages. Secure Trading Limited April 2018 Page 14 / 70

15 Further Searching This can be used to filter the search results shown under the Search Results tab. For example, if you typed Joe Sm as is shown above, the table will display all records that have Joe Sm in a field Sorting the results By default, the Search Results are sorted by the Timestamp field. Click on a column heading to sort the results. For example, clicking on the Amount heading will sort the transactions by the Amount. Secure Trading Limited April 2018 Page 15 / 70

16 Icons Icons can be displayed next to each transaction by clicking on the checkbox on the top left of the search results.using the icons will provide you with an at-a-glance representation of the different states for your transactions. Click here to show the icons. A key corresponding to each icon is displayed in the Status information tab. Refer to section for further information Selecting transactions Under the Search Results tab, you can select multiple transactions by clicking on the checkbox next to each transaction. The screenshot below shows four transactions that have been selected. You can then perform actions on the selected transactions by clicking on one of the buttons on the bottom of the page. For further information on the actions available, see section Viewing transaction details Clicking a transaction reference in the Search Results will display the Single Transaction View which displays all details regarding a transaction. Refer to section for further information. Secure Trading Limited April 2018 Page 16 / 70

17 2.1.3 Status Information The Status information tab contains explanations for the different values returned by the search, including the icons described in section (when in use). Secure Trading Limited April 2018 Page 17 / 70

18 2.1.4 Stored searches Prior to performing a search, you can select from the Stored searches drop-down on the left to quickly populate the page with useful search criteria. We provide a set of pre-defined searches that cover frequently-searched scenarios, but if you prefer, you can store your own search preferences for future use. You can store the following search criteria for when you need to perform another search: Date type Output Filters Fields Selecting user-defined searches from the Stored searches drop-down on the Transaction search page will retrieve the previously-stored criteria listed above. You can make adjustments if required, or you can click Search to process a search using the stored credentials. You cannot store search criteria pertaining to specific transactions or customers. For this reason, the following criteria are not stored: Date/time Transaction reference Card number Order reference Billing names Billing postcode Billing Customer IP Requirements To store search criteria and reload them at a later time, your MyST user account must have one of the following roles (see section 3.4 for further info): Site admin Site user Site user 2 Transaction admin Transaction admin 2 View only transactions View only transactions 2 Basic user Getting started Stored searches can be managed by clicking the Manage searches tab at the top of the page. Secure Trading Limited April 2018 Page 18 / 70

19 Save By typing in a unique name for your search and clicking Save, the search criteria will be retained, allowing to repeat this search at a later time. Searches that you have stored are shown under -Saved- in the Stored searches drop-down. A maximum of 5 stored searches are permitted per user. This includes searches shared by parent users (as described in section ) Share and save It is possible to share stored searches with your child users. This is useful when you manage users that frequently perform the same searches, as it saves them having to reselect the same filters and fields each time. Clicking Share and save opens a pane that allows you to select child users to share the stored search with (see below). 1. Search for users using the search tool at the top of the pane. 2. Allocate users by clicking their name on the left, which will move them to the column on the right. 3. Clicking Save will share the stored search to all the allocated users listed on the right. Searches that have been shared with your MyST user account by other users are shown under -Shared- in the Stored searches drop-down. You cannot modify or delete searches that have been shared with you. Only the owner of a stored search can perform these actions. You can only share stored searches with child users that you manage Delete To delete a stored search, select the search from the Stored searches drop-down on the left of the page, and click on the Manage searches tab. The Search name textbox will automatically be pre-filled with the search you selected on the left. Click Delete to delete this search. Deleting a stored search (see ) will also remove it from any child users that you have shared it with. You cannot delete searches you have not created yourself. It is not possible to remove pre-defined searches, or searches shared to you by other users. Secure Trading Limited April 2018 Page 19 / 70

20 Modifying stored searches Searches can be modified by following these steps: 1. On the Transaction search page, select the name of the search from the Stored searches drop-down on the left. 2. Make adjustments to the search criteria as required. 3. Switch over to the Manage searches tab, and ensure the name of the search you would like to update is shown in the Search name textbox. 4. Press Save. You will be prompted to confirm that you are okay to overwrite the previously-stored search. Click Replace in order to replace the old search criteria with the changes you have made Single Transaction View The Single Transaction View displays details relating to the selected transaction. The transaction details can be printed in a print-friendly format, by clicking the Print button. The Summary table at the top of the page displays general details regarding the transaction you have selected. Below the Summary table you can either view the transaction details or related transactions. Secure Trading Limited April 2018 Page 20 / 70

21 Transaction details The Transaction details tab displays all details for the selected transaction. You can perform actions on your transactions by clicking on one of the buttons at the bottom of the page. For further information on the actions available, see section Secure Trading Limited April 2018 Page 21 / 70

22 Operator username The value of this field contains the name of the user that processed the request. This is assigned in the following situations: For payments processed through Payment Pages, this will always be paymentpages. For payments processed through the MyST Virtual Terminal, this will be the username that processed the request. For payments processed through an API interface, this defaults to the alias submitted in the request or this can be overridden by passing through the operatorname field, nested within the merchant tag Credentials on File (CoF) There are four possible values used to identify stored credentials on a transaction: 0 Credentials not to be re-used (default) 1 Credentials stored for re-use 2 Scheduled payment using stored credentials 3 Unscheduled payment using stored credentials Secure Trading Limited April 2018 Page 22 / 70

23 Security Response To help minimise fraud, checks are performed on Authorisations by the Acquiring bank. These checks typically consist of the following: Use of the Address Verification System (AVS) to check if the provided first line of the billing address matches that on the card issuer s records. Checks to see if the billing postcode provided by the customer matches that on record for their card. Checks to see if the security code (CVV2) provided by the customer matches that on record for their card. Please contact your Acquiring Bank for further information on the checks performed. The results of these checks are displayed in the Security Response section of the Transaction details tab. The security response consists of three different fields, each containing the result of an individual check. The names of the fields are listed, below: MyST field name Security code Postcode House no. Comment The results of the security code checks. The results of the checks on the billing postcode. The results of the checks performed by the AVS on the first line of the billing address. Secure Trading will analyse the details provided by the customer and respond with the following results for each check performed: Security response value Description Comment 0 Not Given Your bank was not provided with the information required to perform this check. 1 Not Checked Your bank was unable to perform checks on the information provided. 2 Matched The information provided by the customer matches that on the card issuer s records. 4 Not Matched The information provided by the customer does NOT match that on the card issuer s records. For example, if the Postcode and House no. security response fields have a value of 2, but the security code security response field has a value of 4, this indicates that the first line of the address and the postcode match those on the card issuer s records, but the security code (CVV2) entered by the customer does not match the code found on the back of their card. Please note that it is possible to perform these checks on a customer s account details without reserving or transferring funds, by performing an Account Check request. See section Secure Trading Limited April 2018 Page 23 / 70

24 Related transactions The Related transactions tab provides a list of all parent and child transactions that relate to the selected transaction. For example, any Refunds or Re-Auths linked to the transaction would be displayed. Secure Trading Limited April 2018 Page 24 / 70

25 2.1.6 Actions available On either the Search Results or Single Transaction View page, you can perform one of the actions outlined in this section. Please note: The actions that can be performed are dependent on the state of the transaction selected. For example, you cannot refund a transaction that has not settled Re-Auth A Re-Auth is where you can process a new Authorisation against the customer s card. On this page, you are able to change the expiry date and also set a different amount than the original transaction. As the security code is not saved in Secure Trading s system, you will need to input the details again, or the card will not pass the security code check. If re-using previously stored credentials, Visa has mandated that you set Credentials on file field to one of the following values: 2 - Scheduled payment using stored credentials 3 - Unscheduled payment using stored credentials If this transaction is to be a Merchant Initiated Transaction (MIT) (opposed to a Customer Initiated Transaction or CIT), Visa has mandated that you specify the reason for the payment, by selecting a value in the Initiation reason field. Rules cannot be inherited by child authorisations. They will only be performed on re-auth transactions if active in the Rule Manager. (see section 4.3) Secure Trading Limited April 2018 Page 25 / 70

26 Refund You can process a full or partial refund for a settled transaction (with request type AUTH ). The following criteria must be met in order for refunds to be processed: The transaction being refunded must be settled (in settle status 100 ). You cannot refund a greater amount than was originally settled. The payment details must still be valid (e.g. the card can t be beyond its expiry date 1 ). 1 Please note if you wish to update the expiry date for a refund, you will need to click on the Show more link to display the field, which is hidden by default. Secure Trading Limited April 2018 Page 26 / 70

27 Update You can update the status of a transaction using the Update option. The transaction can be suspended or set to settle at a future date. The order reference can also be updated. Please note any transactions that have not settled after a certain period following the authorisation are set as cancelled by the system as the authorisation code is no longer valid. This is usually after 7 days, but can vary depending on your acquirer. You can update the amount for a transaction, as long as it is either equal to or less than the amount authorised. If you have selected multiple transactions for update (as described in section ), and need to change all of their settle statuses to the same value, you can use the Options table that is shown at the top of the page: Secure Trading Limited April 2018 Page 27 / 70

28 Account Check When activated on your Secure Trading account, an Account Check request allows a card/account to be validated by checking the customer s address and security code. An Account Check shows the merchant that the customer s account, address and CVV2 value are valid and that it is acceptable to proceed with the transaction. This feature is only available with select acquirers and the number of checks performed may differ based on the payment type. To find out if your acquirer supports Account Check and to activate it on your Secure Trading account, please contact Secure Trading support (see section 6.1). Account Checks can be performed using MyST by selecting a pre-existing transaction and clicking the Account Check button, when shown. No funds are reserved or transferred by the Account Check process, but you may specify an amount. This amount is inherited in future transactions that refer to the Account Check as a parent transaction. Please see section for an explanation of how to view the results of an Account Check MCC 6012 For merchants with MCC (Merchant Category Code) 6012, the additional fields required for every re-auth and account check request are automatically included, when using the MyST interface to process the aforementioned requests. For further information on the required information, please refer to the relevant documentation for your implementation. Secure Trading Limited April 2018 Page 28 / 70

29 2.2 Reporting The Reporting feature of MyST allows you to analyse the requests processed through your account. You can view totals for transaction amounts and number of requests across date ranges for one or more sitereference Generating a report Setting the Sitereference, date range and summary type Select a Sitereference Set the site you wish to generate a report for choosing sites from the SiteReferences box. Multiple sitereferences can be selected by clicking on the sitereference dropdown, and checking the sites that you have access to. Pre-defined reports You can select one of the Pre-defined reports which will set the filters and groupings for you. Setting the date range A date range must be specified for each report. By default, the date range will be set for all transactions for the current month. Summary type The Summary types determines which transactions are included in the generated report (Authorisations and/or settlements). Report Format The report format determines how to structure and display the report: Standard: Display Report in standard Secure Trading format. Analysis: Display a pre-set report format for transaction analysis. Secure Trading Limited April 2018 Page 29 / 70

30 Filters Filter your search criteria using the checkboxes displayed under the Filters heading. For example, selecting USD in the Currencies field will return only transactions that were processed in USD. Secure Trading Limited April 2018 Page 30 / 70

31 Expanding boxes When you move your cursor over the boxes shown under the Filters tab, they expand to show more options. This is to simplify the process of selecting options from large lists. After selecting the desired options, move your cursor away from the expanded box, and it will reduce to normal size Group by You can set how the data in your reports are grouped together using the checkboxes provided. For the above report, transactions would be grouped by Day, then Currency, then the Request type. Secure Trading Limited April 2018 Page 31 / 70

32 2.2.2 Report Results Navigating the Results Pagination To change the number of transactions displayed per page in the results, select the drop-down on the top-left corner of the generated report. Use the buttons at the bottom of the results to navigate between pages Further Searching This can be used to search the generated report. For example, if you typed Jet, the table will display all records that have Jet in a field Sorting the results By default, the generated report is sorted by the Day field. Click on a column heading to sort the report. For example, click on the Settled AUTH value heading will sort the transactions by that field. Secure Trading Limited April 2018 Page 32 / 70

33 2.3 Virtual terminal The Virtual terminal allows you to manually process payments on behalf of customers from within the MyST portal. To access this page, use the Virtual terminal link found in the left side menu. The Virtual Terminal functionality is only available to certain user roles (refer to section 3.4 for further information). If you intend to re-use credentials in a future payment, you will need to set the Credentials on file value to 1 Credentials stored for re-use. This is mandated by Visa. Any re-authorisations processed using this transaction as the parent must also pass through Credentials on file value 2 or 3 (see section ). In order to use the Virtual terminal you will need a MOTO (Mail Order Telephone Order) merchant id. If you do not have one and would like to make use of this facility, please contact our Support team. Contact details can be found in section Process a payment Fill in the form displayed onscreen and press the Process button near the bottom-right of the page. We will process a transaction with the details provided. After a few seconds, you will be presented with a success or a failure result. A success result means that the card has been authorised. If the result is a failure, this means that the card payment has not been authorised and your customer should arrange another way to pay. Secure Trading Limited April 2018 Page 33 / 70

34 2.3.2 IIN Lookup The IIN (Issuer Identification Number) is taken from the first 6-9 numbers of a card and can be used to identify basic information about the card. The IIN Lookup functionality allows users to enter the IIN (or an entire card number) and retrieve this information. The IIN Lookup service enables telephone order sales assistants to check the origin of a customer s payment card and determine whether it attracts a premium interchange rate. This is especially important where the card product may be a commercial card or a consumer premium product card issued outside of the EU or EEA region. Our system will assist you determining if the card is subject to a higher level of interchange. Where a higher level of interchange is sought, the telephone order sales assistant will be able to add the level of interchange as an additional service fee. Refer to the following resources for further info on interchange rates: VISA Mastercard Important: Card issuers regularly update the IIN ranges, affecting the information that is returned by this service. We regularly update our records, but cannot guarantee to return the most recent details in all cases Processing the lookup You can enter the following data into the Card number field: Entire unmasked card number. Masked card number (providing the IIN is not masked). The first 6-9 numbers of a card. Press IIN Lookup to submit the IIN Lookup request. Upon entering a valid IIN or card number, if the information is available to be returned, you will be presented with the following information: Card brand The name of the payment method. Payment type description The English description of the payment method Bin category Type of card identified (e.g. consumer or commercial card) Issuer name Issuer country Secure Trading Limited April 2018 Page 34 / 70

35 2.4 ST PayMe The ST PayMe system simplifies the process of requesting a new payment from a customer. An will be sent to the specified address with a link to a Payment Page, allowing them to process a transaction to your chosen sitereference Specifying the Details Step 1. Select the sitereference that is intended to receive the payment. Step 2. Specify the first and last name of the recipient (included in the ) and their address. addresses can have a maximum length of 255 (maximum of 64 characters before symbol). Step 3. Specify the amount to be paid and the currency. Step 4. Specify the Payment Pages version and profile to be used when the customer performs the payment. There are two options: Version 1 (Legacy) Version 2 (Recommended) Leave the profile field blank, as this is not supported for version 1. If you have customised your Payment Pages with an stprofile, you will need to include this in the profile field, otherwise set this field to default. Secure Trading Limited April 2018 Page 35 / 70

36 2.4.2 Additional Fields Additional fields that can be specified include subject, the reply to address, the order reference, the settle status, the settle due date (must be within the next seven days) and information for Credentials on File (CoF) Credentials on File (CoF) If you intend to re-use credentials in a future payment, you will need to set the Credentials on file value to 1 Credentials stored for re-use. This is mandated by Visa. Any re-authorisations processed using this transaction as the parent must also pass through Credentials on file value 2 or 3 (see section ) Sending an Copy You can choose to send a bcc copy of the payment to another address, for your records. This is done by specifying the additional address(es) in the Bcc to field, before sending. When including multiple addresses, separate with commas(,) or semicolons(;). addresses can have a maximum length of 255 (maximum of 64 characters before symbol). Secure Trading Limited April 2018 Page 36 / 70

37 2.4.5 Additional Information Secure Trading provides a large resizable text box to allow you to enter custom text to be included within the to your customer. (e.g. Personalised message to the customer) Adding a company logo Please refer to section Sending the Once the details have been completed and the Send button has been clicked, an is generated and sent to the customer allowing them to make their payment. When using ST PayMe, we advise the use of the Payment Pages site security feature. Please see the Payment Pages document for further information. When using ST PayMe it is advised to configure the site security without the billingfirstname, billinglastname or billing as these fields may cause the transaction to be rejected. Before sending an to the customer requesting payment, we recommend sending an to your own address to ensure the account configuration and company logo appears correctly. Secure Trading Limited April 2018 Page 37 / 70

38 3 Users 3.1 User details From the User details page you can: View your user details. See which users and sitereferences are allocated to you. View, edit and delete your sub-users and their privileges. View more information on your sitereferences Your User Details The top section of the User details page displays your user details: Name of field Username Role Valid ip/network(s) (Max length 255) Role if invalid IP Last logged in Last logged in IP Locked Two-step verification Comment Your username. Your assigned role. See section 3.4 for further information. You may have limited user privileges or be prevented from signing in when you connect from a network outside of the range specified here. Site admin roles can modify the valid IPs of their sub-users (see section 3.1.3). If you connect from an IP address outside the range(s) specified then your access can be reduced or prevented. See section 3.4 for further information. The date and time you last logged in. The IP address of where you last logged in from. States if your MyST user account is Locked or Unlocked. Locked accounts cannot sign in to MyST. The method of two-step verification enabled on your MyST user account. (If disabled, this field has the value Disabled ). The lower section contains two tabs: Manage sites a list of the sitereferences you have permission to access and allocate to your sub-users. Manage users a list of your sub-users. Secure Trading Limited April 2018 Page 38 / 70

39 3.1.2 Managing your sitereferences The Manage sites tab contains a list of sitereferences that you have permission to access. If you have many sitereferences, you can search by entering all or part of the sitereference in the Search for sitereferences textbox and clicking Search. For further information about a site, click the associated sitereference in the list of SiteReferences. You will be presented with a page similar to the below. See section 4.1 for further information about viewing your site details in MyST Managing your sub-users The Manage users tab contains a list of sub-users assigned to your account. If you have many sub-users, you can search by entering all or part of the username in the Search for users textbox and clicking Search. Please note: Your role defines which actions you can perform on your sub-users. Please see section 3.4 for further information View a user When you click on the username for one of your sub-users the User details page will display their details including their sub-users (in the Manage users tab) and the sitereferences they have access to (in the Manage sites tab). You can edit the user you are currently viewing by clicking the Edit link next to the username. Secure Trading Limited April 2018 Page 39 / 70

40 Edit a user The Edit option allows you to modify the following properties: Name of field New password Role Valid IP/network(s) Role if invalid IP Lock account Reset second step Previous password allowed for (mins) Manage sites tab Manage users tab Comment Change the user s password (must follow our password policy). Change the user s role (see section 3.4 for further information). You may choose to restrict the user s access to certain IP addresses or reduce the access privileges given to a user when they connect from a different network. You can specify a single IP, e.g Multiple IP addresses are separated by either a semicolon (;) or a comma (,). e.g ; Ranges of IPs are be specified by using a netmask in the CIDR format. e.g /8. Assign a secondary role to be assigned when user signs in from outside of the range of valid Ips assigned to them. Lock/unlock a user s account. Locked users are prevented from signing in to MyST. When ticked, this will prompt the user to set up two-step verification next time they sign in (see section ). This field is supported by MyST user accounts used in automated back-office processes. It allows the previous password to be used for a short period of time alongside the new password, before expiring. This allows you to update your system with the new password, and is used to prevent interruption to your services. Change which sitereferences are allocated to this user. Change which sub-users are assigned to this user. Secure Trading Limited April 2018 Page 40 / 70

41 Allocating Sub-users Below the Save button, in the Manage users tab, you can change the sub-users of the currently selected user in the same way as when adding a new username (see section ) Allocating Sitereferences In the Manage sites tab, you can change which sitereferences the currently selected user has access to in the same way as when adding a new username (see section ). Note: Each user must be assigned at least one sitereference. Any changes you make will not be saved until you click the Save button. Changes will take immediate effect Delete a user A user can be deleted by clicking on its associated Delete link on the main User details page (shown below). Secure Trading Limited April 2018 Page 41 / 70

42 3.2 User settings The User settings option allows you to configure security settings on your MyST account Change password To change the password used to sign into MyST, click the Change password tab on the top of the page. You will be presented with a new page where you are required to enter your current password, your new password, and then to confirm the new password. Click the Save button to confirm the change. Please note that the ability to change the password for your MyST account is only available to users with certain roles. For a full list of roles and their abilities, please refer to section 3.4. If the current password is incorrect or the new passwords don t match, then an error message will be displayed. Otherwise a successful save message will be displayed and your password will have been changed Password Considerations Change your password every 90 days. Passwords should not be sent via any form of electronic communication. Use a different password each time you change your password. Never reveal your password to anyone. Passwords should be at least 7 characters long. Passwords should contain the following groups of characters o UPPERCASE letters: A-Z o lowercase letters: a-z o numbers: 0-9 o symbols: ~`!@#$%^&*()_-+={[}] :;"'<,>.? Secure Trading Limited April 2018 Page 42 / 70

43 3.2.2 Two-step verification In the interest of security, we strongly recommend enabling two-step verification. Once enabled, this provides an additional layer of security to protect your account from unauthorised access, by prompting for an access code to verify your identity at sign in. It's easy to set up and only takes a few minutes. Our two-step verification feature is only used to authenticate users signing in to MyST through a web browser, and is not used to authenticate accounts used by automated back-office processes, such as Webservices roles. Two-step verification is mandatory for the following user roles: Site admin, developer and developer 2. You can also opt-in to two-step verification with other user roles. Please refer to section 3.4 to view information on our different user roles. How it works: With two-step verification enabled on your user account, you will be prompted for an access code when signing in to MyST. You open your previously-configured authentication application to retrieve this code. Type the access code into MyST to gain access to your account. To enable two-step verification, follow the first-time configuration steps outlined in section Secure Trading Limited April 2018 Page 43 / 70

44 First-time configuration First-time configuration is easy. Click User settings from the left and follow the instructions displayed on-screen (or read on for further information). Starting the setup process From the User settings page, click the Two-step verification tab. Click the Set up button to start the two-step verification setup process. Note: If your account is already protected, you will be displayed a green message on this page informing you of this. Downloading the authenticator app If you don t already have one installed, you will need to install an authenticator app. This is required to setup two-step verification, and it will also be required every time you sign in to MyST. For mobile devices we suggest: Google Authenticator (Android, ios) Microsoft Authenticator (Android, ios and Windows Phone) Authy (Android, ios) For computers we suggest: WinAuth (Windows) Authy (MacOS, Windows, Chrome Browser) The two-step verification used by Secure Trading follows the RFC-6238 standard. As a result, you can use any authentication application that follows this standard. Secure Trading Limited April 2018 Page 44 / 70

45 Scan the QR code Scan the QR code displayed using the camera on your mobile device to perform verification. OR Copy the authenticator code Hover over the black box displayed under the QR code to view the authenticator code, and enter this into the app to perform verification. Enter the code generated by the app into the "Verification code" textbox in MyST, and click "Confirm" to complete the setup process. This is to ensure the method of authentication has been configured correctly before it is enabled on your MyST user account. If two-step verification has been successfully enabled for your MyST user account, a confirmation message will be displayed at the top of the page to confirm this. Secure Trading Limited April 2018 Page 45 / 70

46 3.3 Add a new username The Add new username option allows you to create a new user, specify which users (if any) they can manage and which sitereferences they have access to. You can only add a new user if your role is Site Admin. See section 3.4 for further information Adding a new user To add a new user, select the Add new username link from the left side menu and fill in the forms displayed User Details Please fill in the fields below when registering a new user. Secure Trading Limited April 2018 Page 46 / 70

47 Name of field Username (required) New password (required) Role (required) Valid IP/ network(s) (Max length 255) Role if invalid IP Lock account Reset second step Previous password allowed for (mins) Comment The user s address. e.g. name@yourcompany.com addresses can have a maximum length of 255 (maximum of 64 characters before symbol). By default, a randomly generated string of characters. You can opt to change this password during user account creation, or at a later time, either by yourself (see section ) or by the user you are adding (depending on role) (see section 3.2). The role of the new user (defaults to Site User). Click the Role details tab for further information (or refer to section 3.4 in this document). You may choose to restrict the user s access to certain IP addresses or reduce the access privileges given to a user when they connect from a different network. You can specify a single IP, e.g Multiple IP addresses are separated by either a semicolon (;) or a comma (,). e.g ; Ranges of IPs are be specified by using a netmask in the CIDR format. e.g /8. In the interest of security, this field is mandatory when creating a Webservices user account. If a user connects from an IP address outside the range(s) specified then their access can be reduced or prevented. Select "Prevent login" to disable access or choose a role with lower privileges. See section 3.4 for further information. Locked accounts are prevented from signing in to MyST. If a user with role site admin is locked, any child accounts they may have will still be permitted to sign in. When ticked, this will prompt the user to set up two-step verification next time they sign in (see section ). This field is supported by MyST user accounts used in automated back-office processes. It allows the previous password to be used for a short period of time alongside the new password, before expiring. This allows you to update your system with the new password, and is used to prevent interruption to your services. Secure Trading Limited April 2018 Page 47 / 70

48 Allocating Usernames In the bottom section in the Manage users tab, you can allocate sub-users to the new user. Usernames are displayed in two columns. On the left is a list of the users which you have permission to allocate (i.e. your sub-users) and on the right is a list of the users being allocated to the new user (i.e. their sub-users). To allocate a username to the new user, click on the required username. The selected username will move from the Available Usernames column to the Allocated Usernames column. If you have many sub-users, you can search for the one you require by entering all or part of the username in the Search for usernames box and clicking Search. To remove a username from the Allocated Usernames column, click on the required username. The selected username will move from the Allocated Usernames column back to the Available Usernames column. You can assign or remove sub-users after the user has been created by selecting the user s Edit option from the main User details page (see section ) Allocating Sitereferences Sitereferences are allocated in the same way as usernames. In the Manage sites tab sitereferences, are displayed in two columns. On the left is a list of the sitereferences which you have permission to allocate. On the right is a list of the sitereferences the new user will have access to. If you have many sitereferences, you can search for the one you require by entering all or part of the sitereference in the Search for sitereferences box and clicking Search. To allocate a sitereference to the new user, click on the required sitereference. The selected sitereference will move from the Available Sitereferences to the Allocated Sitereferences column. To remove a sitereference from the Allocated Sitereferences column, click the required sitereference. The selected sitereference will move from the Allocated Sitereferences column back to the Available Sitereferences column. Each user must be assigned at least one sitereference. Secure Trading Limited April 2018 Page 48 / 70

49 Saving the user Any changes you make will not be saved until you click the Save button. Once you have finished entering the details, click Save to create the user. If any of the values entered are invalid, a warning message will be displayed and the invalid fields will be highlighted in red. Once all of the required fields have been completed correctly, a successful save message will be displayed, the new user will be created and you will be redirected to the Edit User Details page (see section ) where you can make further changes to the newly added user if required. Secure Trading Limited April 2018 Page 49 / 70

50 3.4 Roles Each user in MyST has a role which defines which privileges have been granted to them. When signed into MyST, your role is displayed in the top-right corner of the page, next to your username. Depending on your role, you may not be able to access certain pages or perform certain actions. The following roles are available: Site admin Manual login Change password Two-step verification View site configuration Re-authorise transactions Refund transactions Update transactions Accountcheck transactions Risk Decision transactions View transactions View reports Use the Virtual Terminal ST PayMe View users Search for your users/sites Upload/download custom files Rule manager: o Payment pages URL redirects o URL Notifications o Payment pages send customised customer o Payment pages send customised merchant o Update transaction response o Edit rule configurations o Payment pages required fields Site user Manual login Change password Two-step verification View site configuration Re-authorise transactions Refund transactions Update transactions Accountcheck transactions Risk Decision transactions View transactions View reports Use the Virtual Terminal View users Search for your users/sites View only transactions Manual login Change password Two-step verification View transactions View reports Site user 2 Manual login Change password Two-step verification View site configuration Re-authorise transactions Refund transactions Update transactions Accountcheck transactions Risk Decision transactions View transactions View reports Use the Virtual Terminal ST PayMe View users Search for your users/sites Transaction admin Manual login Change password Two-step verification Re-authorise transactions Refund transactions Update transactions Accountcheck transactions Risk Decision transactions View transactions View reports Use the Virtual Terminal Transaction admin 2 Manual login Change password Two-step verification Re-authorise transactions Refund transactions Update transactions Accountcheck transactions Risk Decision transactions View transactions View reports Use the Virtual Terminal ST PayMe View only transactions 2 Manual login View transactions View reports Secure Trading Limited April 2018 Page 50 / 70

51 Virtual terminal user Manual login Use the Virtual Terminal Virtual terminal user 2 Manual login Use the Virtual Terminal ST PayMe Basic user Manual login Change password Two-step verification View transactions Use the Virtual Terminal ST PayMe ST PayMe Manual login Change password Two-step verification ST PayMe Developer Manual login Change password Two-step verification Upload/download custom files Rule manager: o Payment pages URL redirects o URL Notifications o Payment pages send customised customer o Payment pages send customised merchant o Update transaction response o Edit rule configurations o Payment pages required fields Developer 2 Manual login Change password Two-step verification View site configuration View transactions View reports View users Search for your users/sites Upload/download custom files Rule manager: o Payment pages URL redirects o URL Notifications o Payment pages send customised customer o Payment pages send customised merchant o Update transaction response o Edit rule configuration Webservices Process any automated transactions via Web Services interface (API) View transactions View reports Webservices 2 Process automated authorisations via Web Services interface (API) The aforementioned user roles are shown in a table format (for the purposes of directly comparing their capabilities) in the Help page of MyST, under the Role tab. Secure Trading Limited April 2018 Page 51 / 70

52 4 Sites 4.1 Site details You can view details of a site by selecting the sitereference in the quick view box in the left side menu (as shown above) and clicking the magnifying glass. This will display the details of the selected site, as follows: The site details page is divided into tabs (read on for further information). Secure Trading Limited April 2018 Page 52 / 70

53 4.1.1 Site details tab The Site details tab outlines information about the currently-selected site, including details of how fraud and duplicate checks are configured. Name of field Fraud Run fraud Fraud rating Confidence threshold Excess threshold Duplicate check Duplicate check Duplicate velocity (secs) Auth method Comment The fields under this header relate to the configuration of our internal fraud checks on this site. You can request changes by contacting our Support team (see section 6.1). Indicates if fraud checks are enabled for this site. This is the default fraud value assigned to a transaction following authorisation. (A value of -1 indicates that internal fraud checks have not yet been performed) When fraud checks are performed on your site, transactions will be suspended if the final fraud rating assigned to them meets the confidence threshold. If there are multiple transactions in a short period of time with the same payment details, this will increment the fraud rating assigned to future transactions. The fields under this header relate to the configuration of our internal duplicate checks on this site. You can request changes by contacting our Support team (see section 6.1). Indicates if duplicate checks are enabled for this site. If checks are enabled, transactions will be assumed as duplicates if identical transactions are processed within the timeframe specified here. This defaults to 900 seconds (15 minutes), if enabled. The authmethod value assigned to all transactions (defaults to FINAL ), unless overridden manually. Information on this field can be found in the following documents: Payment Pages / API Accounts tab The Accounts tab provides details of all the accounts set up for the current site. The card types and currencies that you are able to process will be displayed under four headings: Name of field Acquirer Account Type Currency Payment Type Comment The name of the acquiring bank through which you can process requests. These could include ECOM (E-commerce/Internet Transactions), and MOTO (Mail Order Telephone Order Transactions). For further information on the type of transactions you can process, please contact our Support team (see section 6.1). Supported currency for this account. The payment types you are able to process using this account Users tab The Users tab displays all the users that have been registered using your MyST account, that have access to the current site, along with their role, the time they last signed in to MyST and the IP they last signed in from. You also have the options to modify or delete any of these users. Secure Trading Limited April 2018 Page 53 / 70

54 4.2 File manager Clicking on the File manager link on the left-hand side of the MyST screen will display the main File manager page. This allows you to upload files to your Secure Trading sitereference. These files are used with the Payment Pages System and can include images, CSS, HTML and JavaScript files. Further information on using these files with your Payment Pages can be found in the Payment Pages Customisation document Choose a sitereference and click Change site. The upload panel is used to upload new files. The file list is used to display files uploaded to Secure Trading for the selected sitereference. You can also delete or download files, when required. Please note that merchants can upload a maximum of 1000 files per sitereference. All files together must be less than 5MB Selecting a Sitereference Files can be managed for any sitereference that you have privileges for. Secure Trading Limited April 2018 Page 54 / 70

55 To change the sitereference, select it from the drop-down and click Change site Uploading a file Click the Add files button in the uploader section and select the files to upload (or drag the files into the window, if your browser supports it). In this example, example.css and image1.jpg have been selected and are ready to be uploaded. To begin, click Start upload. Please note that only the following file extensions may be uploaded: css, , eot, gif, html, jpeg, jpg, js, png, svg, ttf, woff, woff2 When uploading text files (e.g. CSS, JS), these must be encoded in UTF-8 or ASCII. The maximum size of a file is 1024kb. Files cannot be empty. Secure Trading Limited April 2018 Page 55 / 70

56 Once the files have been successfully uploaded, the Status column will show 100% for each file, and a confirmation will be displayed at the top of the page. The list of files already uploaded will be displayed on the lower part of the page under the Files for <your site name> tab. Typing in the Search text box will filter the files shown to match specified criteria. You can order the files shown by clicking the arrows shown in the column headers. Please note that it may take a few minutes for a file to be uploaded or deleted. Therefore your changes may not appear under the files tab immediately. Please note that there is no duplicate check for filenames. Uploaded files will override existing ones with the same name Using a company logo in customer notifications / ST PayMe In order to use a company logo in customer notifications / ST PayMe, upload an image file via the File manager. When uploading the image, it must have the filename of logo (e.g. logo.png). The supported file types for a company logo are: gif, jpeg, jpg, png, svg. Secure Trading Limited April 2018 Page 56 / 70

57 4.2.3 Deleting and Downloading Files can be deleted or downloaded from the file list. Once you have selected a sitereference, uploaded files will appear on the lower part of the page. To select a file, tick the checkbox next the filename. You can select all files by clicking Select All Deleting Files Once you have completed your selection, click the Delete button. Please note It may take a few minutes for a file to be deleted. Therefore your changes may not appear immediately under the files tab Downloading Files Once you have completed your selection, click the Download button. The file(s) are downloaded in a zip file. You can edit the files and re-upload them with any changes you make. Secure Trading Limited April 2018 Page 57 / 70

58 4.3 Rule manager The Rule manager interface enables you to create distinct rules using your MyST account. Secure Trading then use these rules to perform automated actions on your sitereference(s), under pre-specified conditions. The rule manager allows you to activate/deactivate pre-defined system rules on your account or create your own customised rules. For example: Redirecting a customer to your own website upon a successful transaction. Sending a notification to your system when a transaction has been processed on your site. Updating a transaction upon receiving a response from the acquiring bank Pre-Requisites Rules can only be configured on MyST by users with the following roles: Site admin Developer Developer 2 Please refer to section 3.4 for further information on roles that can be assigned to MyST users Further reading The Rule Manager is explained in greater detail in the MyST Rule Manager supplement. Secure Trading Limited April 2018 Page 58 / 70

59 5 Subscriptions 5.1 Introduction A Subscription transaction is the submission of a standard Authorisation (similar to the AUTH type transaction) with additional recurring information. This will cause Secure Trading to schedule additional continuous authority transactions to be processed at designated intervals, using the Secure Trading Subscription Engine. To activate these additional facilities on your Secure Trading account please contact the Secure Trading support team (see section 6.1). At this time, MyST can only be used to view and update existing Subscriptions. Subscriptions are scheduled by sending a request through the Payment Pages, Web Services or the STAPI client. For further information, please consult our other documentation. All Secure Trading documents can be found on our website. 5.2 Viewing the parent Authorisation The first payment in a series of subscription payments will always be an Authorisation (AUTH) transaction (including 3D Secure Authorisations), often referred to as the parent transaction. You can display details of this parent AUTH by typing its transaction reference into the Quick Search box, under Transactions, in the left side menu within MyST ( and clicking the magnifying glass button (or pressing the return key). Alternatively, you can search for it on the Transaction search page (see section 2.1.1), and click its transaction reference: Secure Trading Limited April 2018 Page 59 / 70

60 Once you have selected the parent authorisation transaction, you will be presented with the following Single Transaction View page: Single Transaction View of a settled parent Authorisation transaction Transaction details tab Secure Trading Limited April 2018 Page 60 / 70

61 To view the Subscriptions scheduled from this AUTH transaction, select the Related transactions tab: Single Transaction View of an Authorisation transaction Related transactions tab Note that the current transaction (in this case, the parent AUTH) is highlighted in yellow. Rows with the Account RECUR and the Request field AUTH represent subscription payments the Subscription Engine has already processed. In the table, any row with the Request field SUBSCRIPTION is a pending scheduled subscription, using the parent AUTH transaction for the billing and payment details. Please note that if there is more than one transaction with the request type SUBSCRIPTION, listed under the Related transactions tab of an AUTH, this indicates multiple Subscriptions have been scheduled from the original AUTH. E.g. A single Parent AUTH which has the following two subscriptions: Subscription 1-1 every month. Subscription 2-10 every 3 months. By clicking on the transaction reference of the Subscription in the Related transactions table (in this case, ), you can view the details of the scheduled Subscription. This will display a new Single Transaction View, with the Subscription details shown. Secure Trading Limited April 2018 Page 61 / 70

62 5.3 Viewing the Subscription To view a Subscription in the Single Transaction View, you can go to the Single Transaction View of an associated parent AUTH transaction (see section 5.2) and the Subscription should be shown under the Related transactions tab: Single Transaction View of an Authorisation transaction Related transactions tab Alternatively, if you already have the transaction reference of the Subscription, you can type it into the Quick Search box, under Transactions, on the left side menu, and click the magnifying glass (or press the return key). You can also search for the Subscription on the Transaction search page (see section 2.1.1). By changing the date fields to a range in the future and performing a search, the next payment scheduled for each subscription that falls within the specified range is shown (including pending and inactive subscriptions). Please note that for each Subscription, only the next scheduled payment will be shown in the search results. Any subsequent payments scheduled in the subscription engine will not be displayed. Secure Trading Limited April 2018 Page 62 / 70

63 It is possible to view only active subscription payments in the Transaction search page, by choosing Active subscriptions from the Pre-defined searches box, before searching. Clicking the transaction reference of a Subscription request in the results will take you to the Single Transaction View for the aforementioned Subscription. The Single Transaction View for a Subscription is very similar to a regular Authorisation request. Details specific to the Subscription can be viewed under the Subscription Details header. Single Transaction View of an active Subscription Transaction details tab Please note that if the Subscription number field has a higher number on the left to that on the right (e.g. 10/9), this indicates that no more subscription payments will be processed, because the Final Number of transactions has been exceeded. Secure Trading Limited April 2018 Page 63 / 70

64 When viewing a Subscription transaction in the Single Transaction View, there will be a Summary table at the top of the page, displaying important information about the Subscription: Summary table at the top of the Single Transaction View for an active Subscription The colour of the Summary table outline indicates the status of the transaction. The possible states of a Subscription are outlined in the table, below: Summary text What this represents This Subscription will become active when the initial AUTH transaction is settled (status 100). The subscription can also be manually set to Active by using an Update. This Subscription will take payment from the customer on the date specified in the Timestamp field. This Subscription will NOT take further payments from the customer, unless the Final Number is changed in an Update. This Subscription will NOT take further payments from the customer, unless set to Active by using an Update. For information on updating Subscriptions, see section 5.4. Secure Trading Limited April 2018 Page 64 / 70

65 To view all scheduled subscription payments in the sequence, click the Related transactions tab. You will see the following table displayed: Single Transaction View of an active Subscription Related transactions tab Note that the current Subscription is highlighted in yellow. The Timestamp field displays when the subscription payments are scheduled to be processed. Secure Trading Limited April 2018 Page 65 / 70

66 5.4 Update a Subscription To update a Subscription, first select a Subscription transaction by using the steps outlined in section 5.3. Step 1: Click the Update button at the bottom of the Single Transaction View page (under the Transaction details tab). Single Transaction View of an active Subscription Secure Trading Limited April 2018 Page 66 / 70

67 Step 2: On the Update transactions page, click the Show more that can be edited. icon to display the fields Update Transaction View of an active Subscription Step 3: Modify the necessary fields that are displayed and click the Update button. Update Transaction View of an active Subscription with Additional Fields displayed Secure Trading Limited April 2018 Page 67 / 70