Bar Card Terminals

We have got two payment terminals from Payment Sense, integrated with our Tevalis tills,

Payment Sense

Our merchant ID with Payment Sense is 520334509715041 for in-person transactions, and 520334510810005 for online ones. Our "head merchant ID", which refers to both, is 878836656883.

PaymentSense can be contacted on [0800 103 2959](tel:+448001032959), for general support.

The terminals are::

* TID: 06563176, Ethernet MAC address: 101EDA8B438B, Handset S/N: 232777303201256453631526, Base S/N: 232777313161294553631154,, Handset model: Move/5000 MOV50BQ Base model: MOVE/BASE Eth/BT

* TID: 06563177, Ethernet MAC address:, Handset S/N:232777303201256453630892, Base S/N:232777313161294553630415, Handset model: Move/5000 MOV50BQ Base model: MOVE/BASE Eth/BT

Manuals for the card readers

Are linked here

Debugging problems

* Check that the card terminal is connected to the base, but checking for a green BT icon, and a signal strength indicator. If this is missing, check the base is powered and [re-associate it with the correct base](#re-associating-with-a-base). If this fails, call PaymentSense Ingenico terminal support.

* Check that the network symbol next to the Bluetooth symbol is green. If not, check the network connection to the base, and internet conectivity for the VLAN it is on (9).

* Check that the card machine has not frozen, by pressing menu. This should bring up the menu. If it has, [reboot it](#powering-off-and-on-the-terminal).

* Check that the card machine can logon to acquirers by [running a logon test](#running-a-logon-test). If this fails, try [running a TMS call](#running-a-tms-call). If this fails, call PaymentSense Ingenico terminal support to get this working.

* Check that the terminal is in [Till Mode, not Stand Alone Mode](#stand-alone-mode), by pressing F4 from the home screen, entering the supervisor password, and pressing the button to turn off stand-alone mode (F1).

* Check that there is internet connectivity from the till.

* Check that the master till working (if not, reboot it) and there is network connectivity to it.

* Check that the correct terminal ID is set and that it is set to use PaymentSense Connect and has the base URL and.

* If none of the above are the problem, call Tevalis.

Finding the TID

The terminal ID can be printed by pressing F3 at anytime (this will print a long status report).

Supervisor password

This needs to be set whenever a replacement terminal is setup. The initial value seems to always be 01483, but should be on the letter with the terminal. You can change it by F1, when it hasn't been set. The value we use, that it should be changed to, is in pass in `it-software/bar-tills/payment-terminals-supervisor-code`.

Running a TMS call

A Terminal Management System call downloads a new configuration from the terminal management system provided by the acquirer, and reboots the terminal with that config. This can paid if the password for the TMS is set wrongly on the device.

To run a TMS call to load an updated configuration, follow these steps:

* Press menu three times to display the second menu page.

* Touch 'supervisor ' password (which is in pass as `it-software/bar-tills/payment-terminals-supervisor-code`).

* Press menu again for the second page of the menu in supervisor mode.

* Touch 'Call TMS'.

* Press F1 to confirm, if necessary.

* Wait for the machine to reboot, or see the report saying there is no update necessary.

Running a logon test

You can force a new logon with the payment processor as follows:

* Press menu three times to display the second menu page.

* Touch 'supervisor ' password (which is in pass as `it-software/bar-tills/payment-terminals-supervisor-code`).

* Touch 'Logon'

* Select 'All'

* Check that the printed report shows `PASS` against both American Express and FDMS.

Re-associating with a base

* Press F3

* Select 'Control Panel'

* Select 'Terminal settings'.

* Select 'Communication means'.

* Select 'Bluetooth'.

* Select Association.

* Select 'Base'

* Select 'Association'.

* Place on the cradle.

* If the Bluetooth symbol is not blue and the signal green, reboot the terminal by [powering it off](#powering-off-and-on-the-terminal) and then placing it on the cradle again and waiting for it to boot.

Powering off and on the terminal

Hold the yellow Clear button, and the punctuation button, together, to shut it down.

Press the green OK button to power it back on.

Stand-alone mode

If, for whatever reason, the card readers cannot be used with the tills, they can be switched into stand-alone mode so that they can take payments independently of the tills.

To do this, from the home screen

* Press F4

* Press the function key to switch on stand-alone mode (F4?)

* Press the red Cancel button to exit the menu

* The card machine should reboot if the mode was changed

Now, to take a payment, type in the amount, in pence, and press the green Enter button. The machine should show the payment screen.

Remember to switch the mode back at the end of the shift, or when the till is working again. This is done the same way as switching into it, but choosing 'Off' instead of 'On'.

Setting up a new/replacement terminal

* Record the serial number, bluetooth address, handset model (top of the label behind the battery), and, if it is a new base, the base serial number, model and ethernet MAC address, and put it in the network device config files repo.

* Place the terminal on the base. It will probably try to do a logon test and fail because it is not yet associated, so just cancel it (twice, once for each acquirer) with the red cancel button).

* Make sure that the TID is the same as the one it is replacing, or, if it is new, contact Tevalis and tell them the new number.

* Set the [supervisor password](#supervisor-password).

* [Associate it with the base](#re-associating-with-a-base).

* Run a [logon test](#running-a-logon-test).

* Test that it works by trying both contactless and chip+PIN card transactions from the till.

PCI-DSS

The [Payment Sense PCI-DSS portal](https://paymentsense.pcidssportal.com/services/login/login) is used to attest to compliance. The login details are in pass, in `it-software/pci-dss/bar-payment-sense`.

Our business profile SAQ type is B-IP. In order to be compliant, we need to schedule a security scan, with an Approved Scanning Vendor (ASV). This can done through the Payment Sense portal.

When the business profile Self Assessment Questionnaire (SAQ) has been completed, and a successful scan has been conducted, the attestation needs to be done. This completes the compliance process.

Answers given to the SAQ, in consultation with the PCI-DSS helpdesk at Payment Sense, are in [PaymentSense_SAQ_Answers.txt](./PaymentSense_SAQ_Answers.txt).

Scans require the IP ranges given to be added to the SSH guard whitelist on the landing VM (or wherever the SSH connection terminates).

The results of a scan scheduled at [14 Jan 2019 10:00:35 p.m are available with comments](./pci-dss-scan-20190114220035.md).

Encryption

Payment Sense have confirmed that our terminals will be using "point-to-point" encryption, i.e. encryption from the terminals to their trusted network/device. This contrasts with the box office one, which uses "end-to-end encryption", i.e. encryption from the *computer it is attached to* to the processor's trusted network/device (yes this terminology is misleading, but it is the terminology used by the payment card industry)..

Page updated

Report abuse