SHA2 and Mastercard Unique Terminal ID Mandate

[AlohaRoss]

I have been getting a bunch of questions about SHA2 along with an assorted amount of answers about it.

I found this for SHA-2

https://www.digicert.com/sha-2-compatibility.htm

Which would have you believe XP with sp3 and IE8 will still work for users.
NCR has been telling its clients XP will not work

What is the minimum Operating system on the Computer running the Aloha EDC Credit card software? Will XP work or does it have to be Win7. Same for Server 2003 and 2008.
For Aloha EDC what is the minimum version. Some say 7.X, others are saying 12.X or 14.X

Here are the firm dates I am hearing from processors that this must be fixed/patched
Dec 28 for users on FirstData
Jan 17 2017 for users on TYSY

Lastly does anyone have information this
MASTERCARD UNIQUE TERMINAL ID MANDATE


Effective January 1, 2017, merchants who do not adhere to the MasterCard Unique Terminal ID mandate which requires unique terminal identifiers for each independent card reading device in a single location, will fall into a status of noncompliance with MasterCard. For each transaction that violates this mandate, you may be assessed a fine by MasterCard.

All merchants with multiple card-reading devices, such as PIN pads, connected to a single host terminal are required to have each of their devices identifiable with a unique Device ID number to remain compliant and avoid fines from MasterCard.


The Fines are steep
Up to $2,500 per occurrence for the first 30 days
Up to $5,000 per occurrence for days 31-60
Up to $10,000 per occurrence for days 61-90
Up to $20,000 per occurrence for subsequent violations

I have not seen a var sheet with unique IDs for each of the Front of House terminals. I have seen in the newer EDC where you can add additional terminal IDs for each FOH term.
I support Aloha and have been upgrading people to ver 12.3.



AlohaRoss

http://www.needaholahelp.com

An Aloha POS 3rd Party support Solution company.

 

[MenulinkMan]

It does matter. SHA2 and BIN2 are the pressing matters for now. December 2017 will be the deadline for unique terminal ID's ( Lane ID's ) to be setup. It will require certain versions of EDC, but that should be covered after the SHA2 version upgrades.

More info as I hear about it.

 

[PosTech72]

I have been working on these for the better part of the last month:

I have had some success with xp but most of our sites are on windows 7.

Min requirements:

POS: for Mastercard Bins 6.7.70
EDC 14.1.20


First Data (CES) - Dec 28th
Heartland (Visanet) - Jan 1
TSYS- Jan 17

For first data ces there is a vxnxxxx.dll that you have to drop into the bin folder while edcsvr is stopped and start edcsvr after its in the bin folder or the 14.1.20 edc upgrade won't work. Just a forewarning.

Today is doomsday for CES first data lol we shall see what happens
The deadline for unique terminal ID's is Dec 2016 not 2017. Although it applies to the new Mastercard Bins so the first of the year is the first time a new mastercard card will issued.

We are still waiting to hear about who needs what in regards to the unique terminal id's

Some processors issue the id's to the merchant and some just require a generic created by the pos provider for each terminal

The bad part is you know it is like pulling teeth to get information from a customer that you need.

Anybody on 12.3 pos and above is good just need the edc upgrade

 

[PosTech72]

Also do not confuse 14.1.2 with 14.1.20
14.1.2 is actually 14.1.02 Don't make that mistake lol

 

[AlohaRoss]

POSTech72, Can you provide a link for the VXNxxxxx.dll you are referring to. I have 14.1.18. I have not received any calls yet regarding CES. Also Heartland has not put a SHA deadline yet only TSYS. The MasterCard change will require every EDC to be reprogrammed with the additional TIDS. That is going to be fun.

AlohaRoss

http://www.needaholahelp.com

An Aloha POS 3rd Party support Solution company.

 

[POSINSAM]

https://dl.dropboxusercontent.com/u/8668925/Aloha/vxnapi.dll

That is the Dll

 

[AlohaRoss]

I had a few calls today for users with Lynksystems (RBS). They must have also decided today was a good day. Why they would do it during the business vacation time, and right before the weekend is crazy. Why not wait until Jan 10th, when the holidays are over and people are back to work.

 

[PosTech72]

Heartland is in fact January 1, 2017

RBS Worldpay may just be doing some testing. I think we have a few weeks at minimum for them.

 

[PosTech72]

14.1.20 is required for MC bins so 14.1.18 is fine for sha-2 just need to get it 14.1.20 or above before mc bin mandate goes into affect whenever that is lol this whole deal is a shit show at best by the processors, card brands etc.

 

[PosGuyUS]

I think you have till August with RBS but they are doing some testing or retiring something in January that could cause some issues.
For FDMS, we had a couple XP SP3 sites with problems using older software Wednesday. No one on Win 7 with older software had the same problem.

 

[Series_of_Tubes]

This is frustrating, seems like people just got a handle on SHA-2 to only be met with BIN and TID issues that require higher versions. The merchant processors have been creating unneeded panic in my opinion. The mandate for TID is 1/1/1 but there is no penalty until 1/1/18 and no fines for BIN until 7/30/17.

 

[PosGuyUS]

The TID requirement came out years ago. The new BIN range for most software is nothing outside of a little programming for many merchants.

 

[AlohaFriendly]

Have any of you guys seen an issue where the 14.1.20 install of EDC seems to go well and approvals will go through, however when you try to settle the batch it kills the EDC application? Running 6.7 Aloha with 14.1.20 EDC. Windows 7 32 bit.

 

[PosTech72]

Aloha Friendly,

I think we have seen a number of these. I am not 100% on the fix but have seen a lot of new var sheets coming from the processors. Typically the terminal ID is changed by the processor. What version 6.7 you running?

 

[TobeThor]

Series of Tubes - Can you please supply a link to where you found those dates re: TID,BIN and corresponding dates/fines?

 

[PosTech72]

I am sure you can reach out to mastercard or your credit card processor and they can probably give you an update.

 

[TobeThor]

PosTech72 - trouble is we are not a CC merchant; rather technology consultants. A small % of our clients are CC merchants and the answer(s) we get from CC processors never seem consistent even when we are getting answers from the same processor albeit a different person/office. It is a struggle to get reliable answers re: these very important topics. We are also getting different answers from POS Dealers that sell, support the same POS!

 

[PosTech72]

You may also try to reach out to NCR. They have been keeping tabs on the timelines for each processor as well as it does impact edc.

 

[gunderburger]

I just got another notice from my Aloha reseller to upgrade for $3385.00. Does this mean the workaround from last fall will no longer work, or will I just get slammed with huge penalties?

Any recommendations on an Ipad based POS for my restaurant?

Thanks, kevin

 

[Series_of_Tubes]

gunderburger - The $3385 has to include more than just an EDC or POS update. What is your reseller saying you need? As long as you are on POS version 6.7.70 and EDC version 14.1.20 or higher you are compliant with SHA-II, Mastercard Bin and support unique TIDS. Depending on you merchant processor you may have to request additional TIDs that will need to be programmed in but that is a simple change.