Vapulus Support

Welcome to Vapulus Support

Payments

Vapulus provides information about payments related actions such as  refunds, or what to do if Vapulus appears on your bank statement

General

  • Why duplicate payments?
  • Help! My payment was automatically captured
  • The Authorized transaction shows ‘Cancelled’ or ‘Expired’ but the shopper hasn’t received a refund
  • What is the difference between payment status and payment lifecycle?
  • There is a processing delay on my transaction

Refunds

  • Can a refund be reversed?
  • Did the shopper receive his refund?
  • Where is the Acquirer Reference Number (ARN)?
  • I want to refund a payment from the Customer Area
  • What funds do I have available to refund shoppers?

Why duplicate payments?

Since our system processes transaction requests directly after being sent from your platform to ours, the system doesn’t include the merchant reference in the payment for uniqueness. Therefore, a shopper could have opened multiple payment sessions from your checkout. An example of how this might occur is, the same shopper opened multiple tabs in the browser, and paid in all the opened sessions. To you, these sessions most likely show the same merchant reference, but Vapulus’ system treats each as a unique payment requests, creating a unique PSP reference for each of the sessions.

Account

Vapulus provides information about payments related actions such as  refunds, or what to do if Vapulus appears on your bank statement

I forgot my password. How do I reset my password?

The Vapulus Customer Area (CA) has a password reset tool to use for such situations.

 

Forgot password (LIVE)

Forgot password (TEST)

 

The tool sends a password reset link to the email address associated with your user account in the Vapulus CA.

 

Enter your account details correctly, so your account be identified. Here are some tips to successfully reset your password:

 

Enter your Vapulus CA company account name in the “Account” field

Your Vapulus CA company account may contain several merchant accounts or subaccounts. For example, merchant account WhereverPeoplePayCOM may be a sub-account of WhereverPeoplePay. You must use your Vapulus CA company account name.

 

Remember, all details are case-sensitive

Both the Company Account name and your user name are case-sensitive. “CompanY” is different from “Company” and “company”

 

Check the environment (LIVE vs. TEST)

The Vapulus Test and Live Environment are separate systems. Be sure that you are on the correct environment when logging in or resetting your password

 

Check your spam/junk folder

The password reset email may have been filtered by your spam filter. Check the spam folder for the e-mail and add do-not-reply@vapulus.com to your address book.

 

Are you looking in the correct e-mail inbox?

You might be registered with another email address.

 

Contact your administrator or IT-Support for help

If there is an administrator or IT-Support in your company responsible for Vapulus, contact them to get a password reset.

 

In some companies, administrators do not allow users to reset the password themselves so the password reset function will not work. In this case, the password reset must be done by the administrator.

 

If you still have trouble logging in, delete your browser cache or try using a different browser. 

 

Please note: Vapulus never provides password information via the phone or email, thereby keeping your account secure.

 

Payment Methods

Vapulus provides information about payments related actions such as refunds, or what to do if Vapulus appears on your bank statement

  • I want to add a new payment method
  • Supporting recurring payment methods
  • I need payment method logos for my checkout or website
  • How can a payment method be deactivated or deleted?

I want to add a new payment method

Additional payment methods may be added by requesting them from your Customer Area (test or live). Go to merchant account level, as payment methods cannot be requested from the company level. Then go to Account > Payment methods, and click Request payment methods.

 

Plugins

I want to connect a partner ecommerce platform to Vapulus

If connecting to Vapulus through one of our preferred partners for ecommerce (for example Magento, Salesforce, Hybris), refer to our Plugins documentation to setup the integration.

Point of sale

Information regarding POS networking, messages appearing on the terminal screens, and transactional information unique to POS.

Troubleshooting common terminal errors

  • There is a check-mark on my Wi-fi menu: Why isn’t my terminal connected?
  • What does “Terminal Not Owned” mean?
  • Why does my terminal say tampered password?
  • “Terminal in Service Mode”
  • My POS says “Credentials invalid”?

There is a check-mark on my Wi-fi menu: Why isn’t my terminal connected?

This checkmark only indicates the WiFi profile is currently active. This checkmark remains even when the terminal is taken out of range of the actual WiFi network.  For an internet connection, there must be both a checkmark and a “WiFi” icon.


Verify whether your terminal is correctly connected to a WiFi network by checking the 5 + Green info menu for an IP address, or trying the PSP Connection Diagnostic Test.

Hardware

How do I track the terminals I ordered?

When an order is placed for a new terminal or replace a terminal, the track and trace information will become available in the Customer Area. When then terminal order or a replacement terminal is shipped, a track and trace is created with the courier company. This code can be used to find the estimated delivery time of the terminals.

 

To track your delivery:

1. Log in to your Customer Area.

2. Switch to your merchant account.

3. Go to Point of sale > Orders and returns.

4. On the row of the request, in the Track & trace column, select the name of the courier company.

5. The track and trace details are displayed. Use these to track your order.

 

If you experience issues with delivery, contact the courier company directly to arrange a more suitable delivery time.

Cleaning and disinfecting my terminal

With the current COVID-19 pandemic, in-store hygiene and cleanliness are more important than 

ever. Below are recommendations for cleaning and disinfecting your payment terminal. Liquids and 

electricity don’t mix well, so before starting, make sure your terminal is switched off and 

disconnected from power. 

 

You will need:

 

1. Clean microfiber cloths.

2. For cleaning: pH-neutral non-scrubbing soap.

3. For disinfecting: alcohol-based cleaner (70-90% isopropyl alcohol).

 

Terminal manufacturers also have an infographic to download with cleaning tips for your staff.

 

How to avoid triggering the tamper alert when cleaning

Terminals are installed with a tamper alert to protect against malicious attempts to alter the terminal’s hardware or software. When this is triggered, the display shows TAMPER or TAMPERED. The terminal is put out of service and needs to be returned to Vapulus.

 

To avoid accidentally triggering the tamper alert when cleaning or disinfecting the terminal:

 

– Check the label of your cleaning product: Never use bleach, hydrogen peroxide, thinner, trichloroethylene, or ketone-based solvents. These substances can cause rubber and plastic to deteriorate and trigger the tamper alert.

– Don’t vigorously scrub or shake the terminal.

– Don’t vigorously rub the terminal with a dry towel or similar or it can cause an electrostatic discharge (ESD), which can trigger the tamper alert.

Other warnings

– Never pour or spray any liquid, sanitizer, or disinfectant directly onto the terminal.

– Don’t clean the smart card reader; that could void the warranty.

– Avoid touching the battery contact points; this leads to corrosion or poor connection.

 

Cleaning procedure

1. Turn off the payment terminal.

2. Disconnect the terminal from power.

3. Slightly dampen a clean microfiber cloth with water.

4. Add a few drops of mild soap or alcohol-based cleaner to the dampened cloth. No need to use any other cleaning product.

5. Do not apply the liquid directly to the terminal. 

6. Gently wipe the damp cloth over the keypad and display.

7. After cleaning, gently wipe the terminal with a clean dry cloth.

8. Only after the terminal is completely dry, reconnect it to power and turn it on.

 

Unless otherwise instructed, do not, under any circumstances, attempt any servicing, adjustments, or repairs on a terminal. Any questions, contact Vapulus Support.

Software

I want to see the contactless limits configured on the terminal

The latest contactless limits per country are posted in the News section of your Customer Area. 

The configuration of the payment terminals is kept up-to-date with these limits.

 

When there is a configuration change, the terminal picks up those changed CVM limits in the next 

automatic maintenance call. No action is needed by you.

 

Why does the software on a V400m terminal need to be upgraded?

The V400m payment terminal has a battery recharging issue. If completely discharged, the battery was unable to recharge. This has been resolved in release V1.50.

 

This is why the software on these terminals to V1.50 (or later) before (re)opening your store must be upgraded. Recharging will still be slow initially, so leave the V400m plugged in to a power source for at least 24 hours.

I see an exclamation point (!) on the terminal screen

An exclamation point on the terminal screen means the terminal is holding data that hasn’t synchronized with Vapulus. This might happen if the terminal lost connectivity, or wasn’t registered under a valid merchant account.

 

Make sure the terminal is connected to the internet and that a successful PSP Diagnostic has been run.

 

If this is the first time the terminal is being used, then board it according to the User manual. 

 

If the exclamation mark does not disappear, contact Vapulus Support with details about the issue.

 

General

I want to see the contactless limits configured on the terminal

To initiate a payment, make a Terminal API call from your cash register. This routes the transaction to the terminal, which prompts the shopper to present their card and verify the payment. The terminal then sends the payment to Vapulus for processing and once the payment is processed, the payment result is available in your integration. 

 

A detailed step by step guide can be found here: Make a Point-of-sale (POS) payment

Start using Point of Sale (POS)

To get started with point-of-sale, a simple set up is required–creating a Vapulus test account, select terminals and build your Integration.

 

For a detailed description of all steps, go to: Get started with your point-of-sale integration

COVID-19: What must be done before reopening my store?

As when any store has been closed for an extended period of time, there are steps to take before reopening and with Covid 19, Vapulus recommends more diligence, especially regarding cleaning and disinfecting.

 

Clean your payment terminal. See: How can I clean or disinfect my terminal for detailed instructions on how to best do that.

At least 24 hours before reopening, connect the terminal to a power supply and turn it on. The terminal then picks up updates that happen overnight.

Do the following basic checks:

After the terminal has booted up, verify that the Vapulus logo or your company logo appears on the terminal display.

If using a V400m terminal, upgrade it to the latest software release (v1.50 or later).

A portable or handheld terminal needs recharging for at least 4 hours, or 24 hours in case of a V400m terminal.

Inspect the terminal for tampering:

Check for missing seals or screws, holes in the device, and anything inserted in or attached to the card reader, ports, display, or keypad. More details in: Regular inspection.

PSP connection test

Open the Admin menu and select Network > Diagnostics > PSP connection. All items should have a green check mark.

To verify that the terminal is operating properly, do a “penny test”:

Make a live payment for a minimal amount, then check the status of this payment in Customer Area > Transactions > Payments.

 

Please note: when payment terminal is turned on after it was off for a long time, it makes a maintenance call to synchronize the configuration and update the software. This can take 10 to 20 minutes before startup is completed.

My terminal isn’t working. I want it replaced!

Before panicking and asking to return or replace a terminal, troubleshoot your issue. This can resolve around 80% of terminal issues. Troubleshooting can be done by either:

 

Checking our POS troubleshooting guidelines

Still not working, contact VapulusSupport for assistance

If the issue can’t be resolved and the terminal needs to be replaced, a replacement or return can then be requested in your Customer Area. If you are not subscribed to the Terminal Replacement Service, you will have to order a new terminal. For information on how you do this, see replace or return terminals.

How can I connect my terminal to Vapulus?

Network connection issues are varied and so are the solutions. The most common symptoms of a connectivity issue:

 

The terminal screen displays “Network disconnected”.

Payments fail or all are being refused.

When pairing the terminal, the Vapulus POS Application showed the message “Failed to communicate with device”.

The terminal failed the “PSP Connection” diagnostic test.

 

Any or all of these might happen when the terminal can’t connect to Vapulus. Either the store’s network, or the terminal’s network settings can be the cause.

 

 To resolve the issue, do the following: 

 

Confirm that your network meets our POS network requirements.

On the terminal, check that a valid IP address is assigned. Sometimes the IP address of the terminal changes (particularly when using dynamic IPs causing a loss of connectivity between the device and the cash register. You can read more about assigning a static IP address here: How can I set a Static IP Address on my Terminal?

Doublecheck the IP address of the terminal. If the IP is 0.0.0.0, your router is not assigning a valid address. Contact your IT/Network team or your internet service provider for assistance.

Make sure all the hardware of your network, such as the cables and router, are working.

Still having issues, reset the existing connection and create a new one. Please also try our troubleshooting steps, to check your specific kind of network.

Checking my terminal’s connection

The PSP Connection test is a diagnostic which tests the steps required for a terminal to connect to the Vapulus backend.

 

This test can be found by pressing 9 + Green > Enter the admin PIN > Network > Diagnostics > Test PSP Connection.

 

– Looking up host: this is to check if the device can resolve DNS (if it fails, your device is not able to resolve Vapulus’ domains)

– Connecting:  this is to check if the terminal can get an IP address (if it fails, something in your network is preventing this device from getting an IP)

– Negotiating: set up secure connection (SSL). If this fails there could be a certificate issue with your device/network

– Write data: send test packet (if fails there could be a firewall blocking traffic from your device)

– Read data: receive a test packet (if fails there could be a firewall blocking traffic to your device)

 

If your terminal fails at any point of this diagnostic, please consult our Network Configuration documentation.

Vapulus for Platforms

Integrating with Vapulus for Platforms?

To go live with the Vapulus for Platforms payment solution, the following need to be integrated:

 

Onboarding and verification: integrate the onboarding API to onboard merchants.

Processing payments: provide split payments in the payment request to the Vapulus payment platform.

Payouts: integrate payout calls using the Vapulus for Platforms API.

 

Note that Vapulus for Platforms does not provide the frontend for sub-merchants. This should be created and maintained by the platform.

I want to pay out my sub-merchants

To pay out Sub-merchants, set up a regular payout schedule daily, weekly, or monthly. Another way to pay out is to set the payout schedule to manual. On manual, a payout can be initiated by making a payout call to /payoutAccountHolder at your convenience.

 

In addition to the payout functionality, funds can be moved between accounts. For more information, refer to Fund transfer.

 

What are Split Payments and how do they work?

Split Payments is a feature to split a payment to several sub-merchant accounts. The split is defined in the payment request, with /authorization or /capture.

 

When the payment is settled, the balance of this payment will be available for payout. For in-depth explanation on how to integrate this, refer to our Vapulus for Platforms documentation under: Processing payments.

What are the Know Your Customer (KYC) requirements?

With Vapulus for Platforms, Vapulus manages most KYC requirements, including Anti-Money Laundering (AML) and Customer Due Diligence (CDD) in line with PSD2 regulations. 

 

It is easy for sellers to sign up, and check their identity at a pre-defined point based on factors including but not limited to, the marketplace, business model, or country. 

 

For more information, refer to the Vapulus for Platforms documentation here: Verification checks.

 

How are refunds and chargebacks managed and deducted in Vapulus for Platforms?

There are some minor differences in the way full and partial refunds and chargebacks are managed: 

 

Full refunds are processed according to the original split. For instance, if $50.00 was deposited into an account and a refund occurs, this $50.00 will be deducted from that same account.

Partial refunds are taken from the marketplace’s account, as it’s not known which part should be taken from which account. Unless a split is defined in a /refund call, then, the refund will be processed according to the split.  

Chargebacks can be configured to be fully taken from the marketplace’s account or taken from the sub-merchant’s accounts, according to the original split.

Finance and reporting

Reports can be used to perform financial tasks such as validating funds received, validating and 

booking costs against your accounts, and reconciling balances.

A detailed step by step guide can be found here: Make a Point-of-sale (POS) payment

What are field adjustments / adjustment bookings?

Field adjustments or adjustment bookings are settlements that are credited and debited as they 

occur and are not related to the sales day. Vapulus uses net settlement which calculates the 

collective total of all settled funds minus refunds and any adjustment bookings like chargebacks. 

Any applicable fees and commissions are already deducted and will reduce the amount transferred 

to your bank account. 

 

Find more information in our documentation here: Settlement payout and charges

Where can I find the Financial reports?

Financial reports can be downloaded from your Customer Area and used to perform financial tasks and reconcile balances:

 

1. Go to Finance > Downloadable reports

2. Select the report to download

3. On the report page, enter a time-period for the generated report

 

For the Settlement details report, enter a settlement batch number.

 

Click Generate.

After the report has generated, under Earlier generated reports, click the file name and it will download.

How can a list of refunds made during a certain time period be generated?

Interactive Payment Accounting report in the customer area can generate this list:

 

Go to Finance >> Interactive payment accounting

Select the following filters:

 

1. Select the required timeframe

2. Choose the time zone you want to use

3. Select the filter on the following journal: Sent for Refund

4. Choose the desired format

5. Generate

 

The report is available for download once generated. Generating the report can take from seconds to minutes, depending of the size of the report.

 

Disputes and fraud prevention

Which chargebacks does Vapulus defend automatically?

Vapulus automatically defends chargebacks in the following situations:

 

Transactions fully refunded before the chargeback was initiated (refund amount is equal to 90% or more of the transaction amount) 

Transaction has 3DS liability shift and chargeback is fraud-related

Multiple chargebacks for one capture/ transaction

Chargeback was initiated outside the allowed timeframe (typically 120 days from transaction date)

Chargeback includes a technical error that invalidates it

Chargeback reason code is not applicable to your Merchant Category Code (MCC)

The 16th fraudulent chargeback on the same card for Mastercard 

 

One of the following may explain a chargeback you feel should have been auto-defended but it was not:

 

Transaction was fully refunded:

Refund was for less than 90% of the transaction amount

Transaction was fully refunded by issuing multiple partial refunds

 

Transaction has 3DS liability shift:

Reason code is not fraud-related

 

Chargeback initiated outside 120-day timeframe:

Timeframe calculated from expected delivery date, not transaction date; this applies to some dispute reasons such as non-delivery of merchandise

 

Please note that chargebacks for some payment methods or specific reason codes are not defendable, and Vapulus auto-defense will not be used in these cases.

 

How can I defend a fraud chargeback?

Defending fraud chargebacks is difficult, and it is recommended to focus on avoiding them – our RevenueProtect system can help with this. 3DS authentication usage can shift liability for fraud chargebacks to the issuing bank, with Vapulus will automatically be defending any fraud chargebacks where 3DS liability shift applies.

 

A fraud chargeback should only be defended if you have compelling evidence that the cardholder participated in or authorized the transaction. It must be shown it was the cardholder who made the purchase, not someone else.

 

To defend a fraud chargeback, submit the following evidence:

 

Correspondence with cardholder

Documentation showing you provided the goods/service to the cardholder (confirmation email, copy of invoice)

Record of previous non-disputed payments

Signed proof of delivery, and AVS match

Courier’s GPS location proving delivery of the product

Evidence cardholder verified account before transaction

Date the cardholder began use of the service

Evidence that cardholder used the service before

 

Please note that providing the items listed here as evidence does not guarantee you will win the dispute – the issuer may still reject your defense.

 

Fraud chargebacks on POS transactions cannot be defended through the Customer Area or Disputes API. If you receive a fraud chargeback for a POS transaction, please contact disputes@adyen.com

 

Refund blocked due to a dispute

If a transaction cannot be refunded, we recommend checking whether an active dispute has been issued upon it. 

 

If yes, then the refund will remain blocked within the Vapulus Customer Area (or fail if you have issued it from your host system), because a refund and a chargeback will result in a double debit to your account. In order to prevent this, Vapulus blocks the refund. 

 

We recommend accepting the chargeback and to allow the cardholder to be refunded through the chargeback process.

 

Risk and performance

Why does Vapulus use fraud score?

Vapulus performs fraud checks on each transaction in compliance with Revenue Protect. These produce the fraud score. 

 

Two types of fraud checks:

 

Pre-authorization checks, performed before the authorization takes place, such as shopper behavior, referral list checks, and so on.

Post-authorization checks, which include data received by issuers, such as AVS data and CVC codes.

 

If both of checks scores combined add up to 100 or more, the transaction will have a Received and Refused status. For more information on how to configure risk rules in our documentation. Go to: Create and use risk profiles.

 

The fraud score for a specific payment can be checked in the Customer Area: go to the payment page of the payment (Transactions > Payments > Search for payment > Click on the PSP reference) and on the payment page click on the number next to Fraud Scoring. This links you to the Risk results page which shows which rules were triggered.

 

To change the calculation for a fraud score or disable fraud score criteria go to: Risk profiles. When changing settings be very careful, as if this is done incorrectly it may cause all payments to be refused.

 

I want to implement manual review of high-risk transactions

 Manually reviewing a transaction before it is captured adds an extra layer of fraud protection. It is commonly used for high value transactions or expanding into high-risk markets. 

 

When a transaction reaches a certain risk score or triggers a specific risk rule, it is sent to case management for manual review. As a reviewer you can then access the case in the Customer Area and accept or reject the transaction.

 

For detailed information and steps about implementing manual review, also known as case management, refer to our docs: Case management.

 

What is the difference between Auto Retries and Auto Rescue?

Auto Retries is a feature of RevenueAccelerate, and automatically retries payments that have been declined due to technical errors, while Auto Rescue automatically retries declined shopper-not-present transactions that have a chance of succeeding. Initial declines can be the result of many different reasons. For example, a shopper’s account initially showed or had insufficient funds, but the payment succeeded when submitted again later. 

 

Auto Retries is free of charge and enabled by default. 

 

To start using Auto Rescue, follow the steps here: enable Auto Rescue.

 

Please explain Auto Rescue

Vapulus’ Auto Rescue automatically retries declined shopper-not-present transactions like subscription renewals. Using smart logic, it decides which declined payments have a greater possibility of success when retried later, and then performs the retries at optimal times. For a detailed explanation visit: Auto Rescue.

 

Law enforcement requests for data disclosure

This article addresses (international) law enforcement authorities seeking data disclosure from Vapulus about its customers and/or business partners.

 

Please note that we are prohibited by law from disclosing any (personal) information to any non- law enforcement authority directly, or to your representatives. For more information, contact the (international) legal assistance service in your area. 

 

In case of an emergency, please contact Vapulus via datadisclosure@adyen.com

 

 

Who is responsible for handling data disclosure requests?

Vapulus is the data processor for payments and personal data collected through the Vapulus platform on behalf of its customers and/or business partners (the data controllers). Vapulus may be prohibited to disclose (personal) data without consent of the customer and/or business partner.  Therefore, we encourage you to contact the customer and/or business partner directly. 

 

Please note that local Vapulus offices only provide commercial assistance to Vapulus, and have no access to any (personal) data. When a data request is directed to Vapulus, Vapulus may only provide information if the data disclosure request is legally binding under law. 

 

 

Information for ? law enforcement authorities

Data disclosure requests from a ? law enforcement authority must comply with the following requirements:

 

The request must be legally binding for Vapulus

The request must be addressed to Vapulus 

The request must include the information listed below.

 

Information for international law enforcement authorities

Data disclosure requests from a non-Dutch law enforcement authority must comply with the following requirements:

 

If you do not have a judicial order, please submit your request via your local authority/agency for Mutual Legal Assistance in Criminal Matters where your request must be authenticated and validated for further processing via Interpol / Europol:

EU related link to Interpol / Europol

Other regions link to Interpol / Europol

If you have a judicial order, please submit your request to the Centre for International Legal Assistance in Criminal Matters in ?

 

The IRC will validate and send through the request to Vapulus on your behalf. Once the request has been received, Vapulus provides the information to the IRC.

 

 

What information needs to be included in the data disclosure request?

Any data disclosure request should include in any event the following information:

 

Formal writing, addressed to?

Clear ground for the legal basis of the request;

Description of the natural person or legal entity about whom the information is requested;

Detailed information in order to retrieve the processed payments on the Vapulus platform. Preferably per payment the unique Vapulus Payment Reference (16 digits);

Name and signature of the issuing authority, badge/ID number of the responsible agent or officer, email address and a direct contact number;

Specific summary of data that is required to be disclosed and the period within which data is sought;

Expected response period. 

 

Important Considerations

The Vapulus support teams are not authorized to disclose any information by telephone or email outside of the process as explained above

Vapulus will only respond to data disclosure requests sent in accordance with the requirements as set herein

Vapulus reserves the right to notify its customers or partners when their (personal) data is being sought, except where providing such notice is prohibited by law. In such case, this must be clearly notified to Vapulus at the time of the request

 

 

PCI compliance

What is in scope for PCI DSS?

The PCI DSS security requirements apply to all system components included in or connected to the Cardholder Data Environment. The Cardholder Data Environment (CDE) is comprised of people, processes and technologies that collect, store, process, or transmit cardholder data and/or sensitive authentication data. This means that the cardholder data environment depends on your technical infrastructure and the Vapulus integration used.

If Vapulus is already PCI DSS compliant why do I have to validate PCI DSS compliance?

PCI DSS applies to all entities that accept credit cards or are involved in payment processing, such as: payment processors, acquirers, issuers, and service providers.

 

To help reduce the scope of PCI DSS compliance, Vapulus makes available integrations that handles most of the PCI DSS requirements. The simplest way for you to be PCI compliant is use our encrypted solutions; it enables you to never see and never have access to unencrypted cardholder data. 

 

When using our encrypted solutions, most PCI DSS responsibilities are outsourced to Vapulus. However, because credit card payments are accepted on your website, your app, or in your physical store, so your integration with Vapulus does not completely eliminate your PCI scope.

What PCI DSS certification does Vapulus have?

Vapulus is fully compliant PCI DSS Level 1 Service Provider, and is recognized as a Principal Member Service Provider of Visa (both Visa Inc. and Visa Europe) and MasterCard. For more information, refer to Vapulus’ role in PCI DSS compliance.

How can we monitor Vapulus’ PCI DSS compliance status?

A copy of our latest PCI DSS Attestation of Compliance (AoC) is available upon request by contacting pci@adyen.com

Can Vapulus assist us filling in a SAQ?

As the name implies, Self-Assessment Questionnaires are meant to be used by merchants and service providers to assess their compliance with applicable PCI DSS requirements. Consequently, Vapulus cannot help to complete Self-Assessment Questionnaires. Vapulus collects the SAQs as part of our obligation towards card brands.

Can PCI DSS compliance be fully outsourced to a third party such as a payment service provider?

No, it is not possible to fully outsource PCI DSS compliance. It is always your responsibility to make sure your service provider is compliant. That said, different connections need different levels of compliance responsibilities as outlined in this article: Why do I have to validate PCI DSS compliance if Vapulus is already PCI DSS compliant?

Can we share our Report on Compliance (RoC) with Vapulus?

No, you should not share your RoC with Vapulus because it contains information about your internal infrastructure, policies, processes and organization that must remain confidential. Vapulus will never ask you to share your RoC and you should share only your Attestation of Compliance (AoC) with us.

How is PCI compliance handled if I am using multiple integration methods?

Using multiple integration methods, several SAQs may be applicable. Vapulus suggests that your PCI compliance be handled per channel. If you operate in multiple regions, compliance with PCI DSS can be attested using a single SAQ, scoped for these regions, providing the same technical infrastructure is used and the same policies and processes are in place. Refer to our PCI DSS compliance guide for more information.

Finding a Qualified Security Assessor

(Vapulus can give the PCI certification to those interested in being PCI certified)

A list of all PCI SSC Qualified Security Assessors can be found on the PCI DSS website: Qualified Security Assessor. Vapulus cannot recommend a Qualified Security Assessor as this audit needs to be performed independently.

 

Finding an Approved Scanning Vendor

Find here: a list of all PCI SSC Approved Scanning Vendors: approved scanning vendors. Vapulus cannot recommend an Approved Scanning Vendor as this audit needs to be performed independently

Security

How do I report a possible security issue to Vapulus?

All reports of possible vulnerabilities or issues are welcomed as part of our responsible disclosure program. At this time, we do not run a bug bounty program.

 

To report a security issue, contact Support. 

 

If the nature of the security issue is sensitive, please provide the following:

 

Describe the issue to help us determine priority.

Provide your PGP public key.

Request contact from the Vapulus security team.

The security team will then open direct communication with you via PGP encrypted emails.

 

Vapulus on my bank statement

Since we do process payments for thousands of brands, you may see ‘Vapulus’ on your bank statement.

What information does Vapulus store about me?

When you purchase a product or service from one of our customers, either instore or online, Vapulus processes your data on behalf of these companies. The company you purchased from is  the data controller, and, as such, will be able to assist you further with any questions regarding the processing of your data. We suggest visiting the website of the company and using their appropriate contact channel for your enquiry.

 

For more information about Vapulus’ certifications, please refer to Certifications.

How do I exercise my data subject rights under the GDPR?

The General Data Protection Regulation (GDPR) provides individuals located in the EU with specific rights regarding their personal data. In order to exercise these rights regarding your purchase of a product or services at one of our customers, visit the website of the company and use their appropriate contact channel for your enquiry. Vapulus, as a data processor, is not able to assist you with such a request.

How does Vapulus protect my payment details?

Vapulus treats your personal data with the utmost of care. It is protected by appropriate technical and organizational measures to safeguard the security of your data. For more information, look at our certifications.

As an individual, can I use the Vapulus platform?

Vapulus is only able to work with legal business entities. The company must be registered at the Chamber of Commerce and have a bank account in the country of primary operation. Therefore, to work with Vapulus as an individual, you have to operate under a corporate form, such as a sole proprietorship.

How can I reach the merchant / shop?

To get in touch with the merchant, look for their contact details on the merchant’s website under “Contact us” or “Support” pages. Some merchants provide contact details in their terms and conditions for escalation. Alternatively, it may possible to contact them through social media.

 

If the merchant ignores your request, you may involve us. Please note, however, that we cannot take action on individual transactions. However, we do collect information on our merchants regarding such matters.

I suspect a fraudulent payment has been made

In the majority of cases where fraud was suspected, the transaction was valid. Vapulus tracks notifications of fraudulent orders and uses the feedback to implement measures that optimize fraud prevention in the future. If you do not recognize the payment, please visit our payment inquiry page.

 

While Vapulus understands the sensitivity of fraud concerns, we are unable to take action on individual cancellation or refund requests. If an incident occurred such as your bank credentials were stolen, please contact your issuing bank immediately.

 

Transactions

Why do I see Vapulus on my bank statement?

It is likely you made a purchase with one of our customers, and as Vapulus is a payments platform used by many merchants, Vapulus may appear on your bank statement instead of the name of the merchant that you purchased from. In some cases, Vapulus may appear with the selling business’ name.

 

Vapulus merely facilitates payments, so we can only help with transaction information. For additional help with your order, subscription, or service, please contact the merchant directly. We are unable to make changes to orders or process refunds on behalf of the businesses that use our technology.

 

If you’re not sure who requested the charge, we can help you identify the merchant so you can submit a request.

 

I want to cancel a subscription

If a transaction appears on your bank statement that you want to cancel, please contact the merchant directly. Vapulus has no information about your subscription agreement with the merchant, therefore, to cancel a subscription contact the merchant directly. This is because Vapulus has no authority to cancel a transaction as Vapulus operates as a payment’s platform for many merchants and web shops.

 According to the rules of credit card schemes, shoppers can cancel subscriptions by sending an email request to their bank.

 

I transferred money to Vapulus’ bank account without a PSP reference

Transferring money to Vapulus’ bank account without PSP reference results in it being marked as unrecognized. Unrecognized funds are automatically sent back to their origin on the following business day. However, it may take the bank several work days to process and return to you.

 

We may be unable to automatically return unrecognized money in some exceptional cases. For example, the money’s origin cannot be determined. A possible reason for this would that in some countries, law prohibits the storing of bank data, so the sender’s bank account number is not visible.

 

If you have not received your money after seven business days, please submit an inquiry here.

 

No receipt or invoice for my order

To get a receipt or invoice for your order, please contact the merchant directly. Vapulus does not receive any information about the status of the order or the products sold, nor do we do not have the authority to issue a receipt. Vapulus is a payment service provider (PSP), as such, we only process the order’s payment.

I want a refund

To get a refund for your order, contact the merchant or web shop where you bought the product or service directly. Vapulus cannot start or stop a payment without the authorization of our merchants, nor can we initiate a refund process on their behalf. This is because Vapulus is a payment service provider, so we only process the payment transaction.

 

Refunds might take up to 2 weeks to be issued. If your refund fails to appear in your account, contact your bank for more information on why the money has not returned.

 

I need confirmation of my order

When ordering online, a confirmation is sent from the web shop where the product or service was ordered. Vapulus does not receive any information about the contents of the order, nor do we have the authority to confirm an order’s status.

 

Therefore, if a confirmation hasn’t been received, we advise you to contact the merchant directly. Vapulus is a payment service provider (PSP), so we are only able to process the order’s payment.

 

How do I see the status of my transaction?

For the status of a transaction made via Vapulus, please contact the merchant where the product or service was purchased.

There is a double payment on my statement

If a double charge appears on your bank statement, contact the merchant where the order was placed and ask to have the second payment refunded. Double payments sometimes occur if you refresh the page during a payment or click submit twice. 

 

In the event money was transferred to our bank account twice, the duplicate transaction will not match a payment request in our system, so the second transaction will then be marked as unrecognized money, and as such, will automatically be returned to your bank account.

 

I want to cancel a transaction

If there is a transaction on your bank statement which you want to cancel, this has to be done through the merchant. Canceling a transaction or recurring payment from a subscription can only be processed by the merchant where the initial purchase was completed. Contact the merchant directly as Vapulus cannot modify the transactions of the businesses using our technology.

Why is my payment blocked / refused?

A transaction can be blocked either by the bank, or due to the risk profile of the merchant. 

 

A negative response from the bank is the most common reason for refusal. There are multiple   causes for this: the card number or CVC is incorrect; the amount exceeds your limit, or foreign currencies are not accepted on your card. If the problem persists, your issuing bank can provide the specific reason.

 

Refusal can be on the merchant’s side. Merchants set up risk profiles to avoid fraud. Your transaction may be flagged as fraud by this safety mechanism. If this incorrect, please contact the merchant directly. If the merchant requires assistance to resolve this issue, they can contact Vapulus.

 

Where’s my refund?

A refund can only be issued by the merchant. Once this action is successfully initiated, it sometimes takes several business days to process the reimbursement. The settlement delays for different payment methods are found under: Transaction Information.

 

If the funds were not received within the settlement delay period, a refund document with an Acquirer Reference Number (ARN) can be requested. This document has all details of the refund and with it your issuing bank can locate the funds.

 

In case that the funds cannot be located, a written statement from your bank, confirming the absence of the funds is required for Vapulus to take any action.

 

I did not receive my flight tickets

If your flight tickets have not been received, contact the airline directly to locate and fulfil your order. 

 

As a payment service provider (PSP), Vapulus only processes the order’s payment. For this reason, Vapulus has no information about the products sold or the order’s contents.

 

In some cases, the airline may require a valid proof of payment from your bank or credit card statement. If the bank or credit card company are not able to locate the transaction, send the proof of payment to Vapulus and we may be able to provide your unique PSP reference, which can be used by the airline to locate the payment and expedite the issue of your tickets.

 

For urgent matters, in some cases it is permitted for us to see a booking number for the flight associated with a payment.

 

Promoted articles

I forgot my password. How do I reset my password?

To reset your password, please use the password reset tool in the Vapulus Customer Area (CA):

 

Forgot password (LIVE)

Forgot password (TEST)

 

The tool sends a password reset link to the email address associated with your user account in the Vapulus CA.

 

Please enter your account details correctly so your account can be identified. The following tips will help to successfully reset your password:

 

1. Enter your Vapulus CA company account name in the “Account” field

Your Vapulus CA company account may contain several merchant accounts. You will need to use your Vapulus CA company account name, not a sub-account.

 

2. Both are case-sensitive

Both the Company Account name and your user name are case-sensitive. “CompanY” is different from “Company” and “company”

 

3. Check the environment (LIVE vs. TEST)

The Vapulus Test and Live Environment are separate systems. You must be on the correct environment when logging in or resetting your password

 

4. Check your spam/junk folder

The password reset email may have been filtered by your spam filter. Check the spam folder for the e-mail and add do-not-reply@adyen.com to your address book.

 

5. Are you looking in the correct e-mail inbox?

You might be registered with another email address.

 

6. Contact your administrator or IT-Support for help

Contact the administrator or IT-Support in your company responsible for Vapulus to get a password reset.

 

In some companies, administrators do not allow users to reset the password themselves and the password reset function will not work. In that case, the administrator must do your password reset.

 

Still having trouble logging in? Delete your browser cache or try using a different browser. 

 

Password information is never provided via the phone or email to keep your company account secure.

 

Adding a new payment method

Payment methods can be added by requesting them from your Customer Area (test or live). Payment methods can only be requested at merchant account level, not from the company level. Once on the merchant account level, go to Account > Payment methods, and click Request payment methods.

 

To request payment methods, the Manage payment methods role in the Customer Area is used. If this is not accessible to you, contact your admin user.

For a complete list of payment methods, see Payment methods overview.

For a complete list of payment methods, see Payment methods overview.

First, sign up for a test account by filling out the form and clicking Submit. Then, you will receive an email with instructions on how to activate your Vapulus test account.  Test accounts are only available to business email addresses. 

 

To learn the steps needed before live payments can be processed, see Getting started.

Which payment methods support recurring payments?

An up-to-date list of payment methods that support recurring payments can be found in the payment methods overview.

 

How does the fraud score work?

As part of Revenue Protect, Vapulus performs fraud checks on each transaction. The fraud score is the outcome of these checks. 

 

What are the two types of fraud checks and how do they work?

 

Pre-authorization checks are performed before the authorization takes place, such as shopper behavior, referral list checks, and so on.

Post-authorization checks include data that is received by issuers, such as AVS data and CVC codes.

If the fraud score of both types of checks together equal 100 or more, the transaction will receive a “Received and Refused” status. More information on how to configure risk rules is found in: Create and use risk profiles.

 

To check the fraud score for a specific payment, go to the Customer Area, go to the payment page of the payment (Transactions > Payments > Search for payment > Click on the PSP reference) and on the payment page click on the number next to Fraud Scoring. You will be linked to the Risk results page, showing which rules were triggered.

 

It is possible for the calculation for a fraud score to be changed, or even completely disabled. Go to fraud score criteria in Risk > Risk profiles. When changing settings, be very careful, as if done incorrectly all payments to be refused.