Authorize.Net Payment Gateway – Recommended Security Actions

Overview

GraceSoft has identified unusual payment authorization activity involving unexpected $0.01 authorization transactions between September 29 and October 19, 2026, associated with an Authorize.Net merchant account.

These authorizations may have resulted in temporary holds on affected payment cards. We are investigating the source of this activity. At this time, the initiating source and any relationship between the activity and a potential application security issue have not been conclusively established, and no confirmed financial loss has been identified.

As a precaution, we recommend that customers using the Authorize.Net payment gateway review their merchant account and complete the security actions outlined below promptly.

1. Regenerate the Transaction Key

As a precautionary security measure, we recommend regenerating your Authorize.Net Transaction Key and updating the corresponding configuration in GraceSoft.

1. Log in to your production Authorize.Net Merchant Interface.

2. Navigate to Account → Account and API Settings → API Credentials & Keys.

3. Under Transaction Key, select the option to generate a new Transaction Key.

4. Choose when the existing key should expire: immediately or after 24 hours, depending on the options presented.

5. Coordinate the change with your authorized technical team to minimize the risk of payment processing interruptions.

6. Submit the request and complete any required PIN or one-time passcode verification.

7. Copy and securely store the new Transaction Key. Ensure it is accessible only to authorized personnel.

8. Provide the new key to your authorized technical team through an approved secure channel.

9. Update the payment gateway configuration in GraceSoft under Setup → Account → Credit Card.

10. Test the payment workflow and confirm that transactions are processing successfully before considering the change complete.

Important security precautions

• Never send your Transaction Key through ordinary email or include it in screenshots, support tickets, or application logs.

• Do not share your merchant account password, Transaction Key, or full payment card details with unauthorized personnel.

• Do not expire the existing key immediately unless the replacement configuration is ready or immediate revocation is necessary to address a suspected compromise.

• If you suspect that your merchant account credentials have been compromised, contact Authorize.Net and GraceSoft Support promptly for assistance.

2. Review Recent Transactions

Review your Authorize.Net transaction history for the period covering September 29 through October 19, 2026, and check for unexpected authorization activity, including $0.01 authorizations.

If you identify unfamiliar transactions:

• Record the transaction IDs, dates, amounts, and other relevant references.

• Contact Authorize.Net to review the transactions and determine the appropriate action.

• Contact GraceSoft Support if you require assistance reviewing the payment gateway configuration or related application activity.

Do not include full card numbers, passwords, or sensitive authentication credentials in support communications.

3. Verify Payment Processing

After completing the recommended security actions, verify that your payment gateway configuration is correct and that payment processing continues to function as expected.

4. Contact Support

If you need assistance reviewing your payment gateway configuration, updating your Transaction Key, or investigating unusual authorization activity, contact GraceSoft Support and provide the relevant transaction references.

For your security, do not send passwords, Transaction Keys, or full payment card details by email or through support tickets.

Recommendation

We recommend completing these security checks promptly to help reduce the risk of further suspicious activity and protect your payment processing operations.

0 Votes