Skip to main content

Swipe and Two-Factor Authentication (2FA)

Updated

Overview

Swipe, NMI's point-of-sale app, now supports optional two-factor authentication (2FA) at login, and all merchants must update Swipe to the latest version by December 31, 2026, to help meet the Payment Card Industry Data Security Standard (PCI DSS) v4.0.1. Partners should use this article to help merchants update Swipe and decide whether to turn on 2FA. The update only changes how users sign in to Swipe. It doesn't affect the Merchant Portal, transaction processing, or card reader setup.

Key Dates

Date What Happens
November 9, 2026 Users can turn on 2FA in Swipe with an authenticator app
December 31, 2026 Deadline: merchants must update Swipe to the latest version

What Is Two-Factor Authentication (2FA) in Swipe?

Two-factor authentication (2FA) adds a second step to signing in to Swipe. With 2FA on, a user enters their username and password, then a six-digit verification code from an authenticator app, such as Google Authenticator or Microsoft Authenticator. 2FA in Swipe is optional, but NMI recommends turning it on.

Why It Matters for Partners

  • Partner responsibility: Share the update steps below with every merchant who uses Swipe, and recommend turning on 2FA.
  • Merchant impact: Merchants must update Swipe by December 31, 2026, or they won't be able to keep using it. Turning on 2FA is optional.
  • Operational context: The update helps partners and merchants meet the PCI DSS v4.0.1 standard, which protects merchant accounts. It doesn't change how transactions process or how card readers are set up.

Prerequisites / Access Requirements

  • A Windows computer that runs Swipe, with permission to install software
  • The merchant's existing Swipe username and password
  • An authenticator app, if turning on 2FA, such as Google Authenticator (iOS, Android) or Microsoft Authenticator (iOS, Android)

How It Works

Update Swipe

Partners: please share these steps with your merchants who use Swipe. We recommend updating well before the deadline to avoid interruptions.

  1. Download the latest version of Swipe: Swipe 7.0.0 installer.
  2. Run the installer on every Windows computer that uses Swipe.
  3. Open Swipe and sign in with your username and password.
  4. Decide whether to turn on 2FA. We recommend it.

Turn On Two-Factor Authentication (Recommended)

With 2FA on, users sign in with their username and password and a six-digit verification code from an authenticator app, such as Google Authenticator (iOS, Android) or Microsoft Authenticator (iOS, Android).

Users who turn on 2FA are guided through setup. They scan a QR code with their authenticator app and enter a verification code.

Swipe supports authenticator app codes only. Email verification codes aren't available in Swipe. Users who currently use email-based 2FA in the Merchant Portal need to set up an authenticator app if they want 2FA in Swipe.

Users who turn on 2FA also receive one-time recovery codes. Store them somewhere secure in case you lose access to your phone.

Daily Sign-In

Swipe signs users out once a day. By default, the session ends at 2:00 AM, using the computer's local time. The next time Swipe is used, the user signs in again. A session lasts 24 hours at most.

Users with 2FA on enter their password and a new verification code. Users without 2FA enter their password only.

The 2:00 AM end time is a default. It can be changed to a different time with a setting in the Windows registry on the computer that runs Swipe.

If a Merchant Doesn't Turn On 2FA

Users can keep using Swipe without 2FA. They must log in every day and change their password every 90 days, the same as the existing Merchant Portal requirements.

Common Questions

  • Do merchants have to turn on 2FA? No. It's recommended, not required. All merchants who use Swipe do need to update to the latest version.
  • What happens if a merchant doesn't turn on 2FA? They log in every day and change their password every 90 days.
  • Does the update cost anything? No.
  • Does 2FA add a step to every sale? No. It applies at sign-in only. Transaction processing and card reader setup don't change.
  • Can merchants get codes by email or text? No. Swipe supports authenticator app codes only.
  • Why is this changing? To help meet the PCI DSS v4.0.1 standard and protect merchant accounts.

Key Definitions

  • Two-factor authentication (2FA): An extra verification step at sign-in, used along with a username and password.
  • PCI DSS v4.0.1: The Payment Card Industry Data Security Standard, version 4.0.1, an industry standard for protecting cardholder data.
  • Authenticator app: An app, such as Google Authenticator or Microsoft Authenticator, that generates a time-based verification code for signing in.
  • Recovery code: A one-time code issued when a user turns on 2FA, used to sign in if they lose access to their authenticator app.

Need Help?

For additional support, please contact our Support team by Submitting a Ticket: https://support.nmi.com/hc/en-gb/requests/new.

Related to