As of 4/30, 2025, we have implemented additional requirements to our password construction flow in the Merchant Interface to ensure full adherence to PCI compliance standards.

This update does not affect existing passwords. We are not enforcing current users to update their passwords as a result of this change.

The new rules only apply for the following scenarios:

• New account creation
• Adding a new user
• Password reset via "Forgot Password"
• Forced password updates due to policy expiration

New additional password validation rule:

• Minimum password length must be 12 characters
• Password should not contain user id and credit card info

Other existing passwords outlined on this article still applies. 

To change your Merchant Interface password, follow these steps:

1. Log in to the Merchant Interface.
2. Select Account from the main toolbar.
3. Select User Profile from the main left side menu.
4. Select Change Password.
5. Enter your current password.
6. Enter a new password. Please note the following requirements:
   • Your password must be at least twelve characters long. Longer passwords may be even stronger.
   • Your password must include a combination of upper and lower case letters, numbers, AND non-alphanumeric symbols.
   • Your password must include at least one special character (e.g. ! @ $ _).
   • Your password may not be a standard dictionary word, even if it is spelled backwards.
   • Your password may not use common symbol substitutions for letters, such as $ for s.
   • Your password may not be the same as your user login ID.
   • Your password may not contain credit card info.
   • Your password may not be blank.
7. Re-enter the new password.
8. Select Submit.

Authorize.net recommends that you also consider the following guidelines for safeguarding your password and increasing the security of your payment gateway account:

• Your password should not contain any information about you that can be easily discovered, such as a spouse or child's name, a license plate or street address number.
• Do not share your password with anyone. If you have reason to believe that your password may have become compromised, change it immediately.
• Do not write your password down. Keep it in memory only. If you absolutely must write your password down, store it in a secure location accessible only to you.
• Do not enable settings that allow your Web browser to “remember” your password.
• If for any reason you need to share your password, do so only in person or over a live phone call with an authorized person. Never share your password via email or voice mail.
• Never display or transmit your password in any communication or online transmission (other than when logging into your account).
• Never share your user login ID and password in the same communication.