TYPE: SERVICE NOTICE

NOTICE ID(s): 20250304.0

NOTICE BRIEF:

Action Required: Set Up Multi-Factor Authentication with TC Vault®

Payment Card Industry Security Standards Council (PCI SSC) PCI DSS 4.0 requires Multi-Factor Authentication (MFA) for all accounts that have access to card holder data.

These requirements take effect this month, March 2025, and MFA will be required for all TC Vault accounts.

As previously communicated, if you haven’t already done so, TrustCommerce will automatically enable MFA for all TC Vault accounts on March 19, 2025.

Here are the steps to get started using MFA:

1. Have an authorized user for your account reach out to your assigned Account Manager, Solutions Consultant or Client Services at 800.915.1680 option 1 or support@spherecommerce.com to opt in and have MFA enabled. Have your custID(s) that you would like to enable for MFA available.
2. Choose your preferred authenticator app, such as Microsoft Authenticator, Google Authenticator, Duo Security, for example.
3. When enabled, the next time a user logs in to TC Vault, they will be prompted to set up/enroll their account in their preferred authenticator app.

To learn more, see Multi-Factor Authentication in the TC Vault User Guide.

CONTACT: Should you have any questions, please contact your Sphere Account Manager or Sphere Client Services at (800) 915-1680, opt. 1.

This is not a promotional message; you are receiving this notification as a service message.

This notice is a confidential and privileged message from SphereCommerce, LLC and is intended only for the use of the individual(s) or entity(ies) identified above as the addressee(s). Furthermore, this e-mail is covered by the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510-2521 and is protected as provided therein. If the reader of this message is not an intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately by phone or email and destroy all contents immediately.