In August 2024, Fiserv began urging merchants to enable PassKey encryption in order to access their merchant processing statements, presenting it as a security enhancement. Before you opt in, it is worth understanding what it actually changes.
ClientLine is the Fiserv portal where merchants pull their processing statements. Encryption applied there is designed for highly classified financial documents owned by a single individual. That is not what a business account is. A business account has a bookkeeper, a controller, an accountant, sometimes a CFO, and sometimes an outside firm reviewing the fees.
The security framing is not wrong exactly. Encryption does what encryption does. The question is whether the model it assumes, one document with one owner, has anything to do with how your company actually operates.
After this is turned on, who can still open my statements?
If the answer is a single named individual, work out whether that is genuinely how you want your financial records held. In most businesses the person who logs into the processor portal is not the person who reviews the fees, and a control that assumes they are the same person creates a problem rather than solving one.
Consider also what happens when that individual is on holiday, leaves the company, or simply forgets the credential. The recovery path for encrypted documents is generally worse than the recovery path for a forgotten password.
This has nothing to do with passkeys in the sense most people now use the word, the passwordless sign-in standard that replaces passwords on consumer websites. Those are a genuine security improvement and worth adopting. The similarity in naming is unhelpful, and it is worth being clear which one you are being asked about.
None of this means you should hand out portal logins. You should not, encryption or no encryption.
That last one matters more than it sounds. Your statements are the evidence of what you have been charged. Anything that makes them harder for your own people to reach is worth a second look, whatever it is called and whoever is recommending it.
If you want to know what is actually on those statements, the statement decoder explains the line items, and why monitoring is critical covers why somebody needs to be reading them every month.
ClientLine is the Fiserv portal where merchants pull their processing statements. PassKey encryption is an option offered there, presented as a security enhancement. Note that this is unrelated to passkeys in the general sense, the passwordless sign-in standard used by consumer websites.
Because of who it locks out. Encryption designed around a single document owner means that anyone you have legitimately authorised to look at your statements, an accountant, a CFO, a fee auditor, can lose access. The account holder keeps access. Everybody else does not.
Ask one question first: after this is enabled, who can still open my statements? If the answer is only one named individual, decide whether that matches how your business actually runs. For most companies it does not.
You do not need to share portal credentials. Statements can be downloaded as PDFs and sent directly, which is how our free audit works. Sharing logins is bad practice regardless of what encryption is in place.
Get Your Free Audit | Schedule A Free Consultation
Subscribe to insights | Read more Insights | Submit an article idea
By implementing PassKey encryption, only one employee’s cell phone will have access to your account, effectively locking out everyone else.
Read More Check out our other insights here
If Bank of America handles your credit card processing, go and pull your last three statements before you read any further. We have watched accounts at that bank move from four basis points to over forty, and the businesses paying it were told the new
Do you have a “Risk Fee” on your credit card processing statement?
No? Good. You are luckier than a lot of merchants, and you should keep reading anyway.
