Password Policies and Security

ProPay WEB uses password protection to secure access to sensitive payroll data. This guide explains password requirements, security policies, and best practices for maintaining secure passwords.

Understanding ProPay WEB Passwords

Three Types of Passwords

Employer User Passwords

• Created by administrator during user setup
• Starts as temporary password
• User must change on first login
• Encrypted and private to the user

Employee Passwords

• Default format: Employee Number + Last 4 of SSN
• Automatically available for all employees
• Must be changed on first use
• Known only to the employee

Administrator Passwords

• Set when first administrator account created
• Full system access
• Should be strongest and most protected
• Must be documented securely

Default Password Formats

Employer User Default Password

When an administrator creates an employer user account:

1. Administrator leaves password field blank
2. Clicks "Temporary Password & ID" menu option
3. System generates random temporary password
4. Administrator provides temporary password to user
5. User must change password on first login

Employee Default Password

Employee passwords follow an automatic format:

Formula: Employee Number (4 digits) + Last 4 digits of SSN

Example:

• Employee Number: 0999
• Social Security Number: 123-45-9876
• Default Password: 09999876

First Login Behavior:

1. Employee logs in with default password
2. System detects default password
3. System forces immediate password change
4. Employee creates personal password
5. Only employee knows new password

Password Requirements

Minimum Requirements

ProPay WEB enforces these password requirements:

Length

• Minimum 6 characters
• Recommended 8-12 characters
• No maximum limit

Characters

• Letters (uppercase and lowercase)
• Numbers
• Special characters allowed
• No specific complexity requirements enforced (but recommended)

Restrictions

• Cannot be blank
• Cannot contain spaces
• Should not match username
• Should not be easily guessable

Recommended Password Strength

While not enforced by the system, users should create passwords that:

Include Mixed Character Types

• Uppercase letters (A-Z)
• Lowercase letters (a-z)
• Numbers (0-9)
• Special characters (!@#$%^&*)

Avoid Common Patterns

• Not a dictionary word
• Not sequential numbers (123456)
• Not repeating characters (aaaaaa)
• Not personal information (name, birthdate)
• Not company information (company name, phone number)

Strong Password Examples

• P@yr011W3b2024
• MyC0mp@ny!Pay
• Secure#Payro11

Weak Password Examples

• password
• 123456
• companyname
• abc123

Forced Password Changes

When Password Changes Are Required

ProPay WEB forces password changes in these situations:

First-Time Login

• New employer user logs in with temporary password
• Employee logs in with default password
• System detects initial password
• Login blocked until new password created

After Password Reset

• Administrator resets forgotten password
• New temporary password generated
• User must change on next login

Password Change Process

When forced to change password:

1. Enter username
2. Enter temporary or default password
3. System prompts: "Password must be changed"
4. Enter current password again
5. Enter new password
6. Re-enter new password to confirm
7. Click "Change Password" or "Update"
8. System confirms change
9. Login with new password

Password Reset Procedures

For Employer Users

User Requests Reset:

1. User contacts payroll processor or administrator
2. Identifies themselves (verify identity)
3. Requests password reset

Administrator Performs Reset:

1. In ProPay, go to Utilities > ProPay WEB > Web Users Management
2. Click Temporary Password & ID
3. Select user's company
4. Select specific user
5. Click Generate or Reset
6. System creates new temporary password
7. Provide temporary credentials to user securely
8. User logs in with temporary password
9. System forces password change
10. User creates new personal password

For Employee Users

Employee Requests Reset:

1. Employee contacts employer or payroll processor
2. Verifies identity (never give password to unauthorized person)
3. Requests password reset

Reset to Default:

Option 1 - Employer with Administrative Rights:

1. Log into ProPay WEB
2. Go to employee management or change employee screen
3. Find "Reset Web Password" button or option
4. Click to reset password to default
5. Password becomes: Employee# + Last4SSN
6. Provide default password format to employee
7. Employee logs in and is forced to create new password

Option 2 - Payroll Processor:

1. Processor performs same steps in ProPay desktop
2. Or manually resets in database
3. Provides default password format to employee

> Important: Administrators cannot see the employee's current password. They can only reset it to the default formula, forcing the employee to create a new one.

Password Security Best Practices

Creating Strong Passwords

Use a Passphrase

• String of words or sentence
• Example: "I process payroll every Friday!"
• Becomes: IprocP@yr0llEvryFri!

Use Password Manager

• Let software generate and store complex passwords
• One master password for the manager
• Different password for each account
• Most secure option for multiple accounts

Make it Memorable

• Choose something you'll remember
• But not something others can guess
• Avoid writing it down where others can find it

Protecting Your Password

Never Share

• Don't give password to anyone
• Don't email passwords
• Don't write password on sticky notes
• Don't save in unsecured files

Where to Save Passwords

• Password manager software
• Secure encrypted file
• Locked safe or file cabinet
• Not in plain text on computer

What to Avoid

• Sharing with coworkers
• Using same password for multiple sites
• Writing on monitor or desk
• Saving in browser on shared computers
• Sending via email or text

Changing Passwords Regularly

Recommended Schedule

• Change every 90 days (quarterly)
• Change immediately if compromised
• Change when employee leaves company
• Change after any security incident

How to Remember

• Set calendar reminder
• Use versioning (MyPassword01, MyPassword02)
• Update password manager
• Document change date

Session Security

Automatic Session Timeout

ProPay WEB includes session timeout for security:

How It Works

• After period of inactivity, session expires
• Timeout period set by system administrator
• Typically 15-30 minutes of inactivity
• User must log in again to continue

Why It Matters

• Protects unattended computers
• Prevents unauthorized access if you walk away
• Automatic security when you forget to log out

Best Practice

• Save work frequently
• Log out manually when finished
• Don't rely only on timeout

Manual Logout

Always log out when finished:

1. Click Logout or Sign Out link
2. Wait for confirmation page
3. Close browser window
4. Especially important on shared computers

Multi-User Access Control

Individual Accounts

Each Person Gets Own Account

• No shared generic accounts
• Allows tracking who did what
• Individual accountability
• Better security

Why Individual Accounts Matter

• Audit trail shows who entered data
• Can identify errors by user
• Security violation traced to individual
• Appropriate access levels per person

Access Levels and Passwords

Different access levels have different security needs:

Administrator Accounts

• Highest security risk
• Use strongest passwords
• Change frequently
• Limit number of admin accounts
• Protect credentials carefully

Data Entry Accounts

• Can modify payroll data
• Use strong passwords
• Change regularly
• Monitor for suspicious activity

View-Only Accounts

• Lower security risk
• Still require secure passwords
• Less frequent change schedule acceptable

Troubleshooting Password Issues

Forgot Password

Problem: User cannot remember password.

Solution:

• Request password reset from administrator
• Receive temporary password
• Log in with temporary password
• Create new password
• Use stronger/more memorable password

Prevention:

• Use password manager
• Write down and store securely
• Create memorable but secure password

Password Not Accepted

Problem: System rejects password during login.

Possible Causes:

• Typing error
• Caps Lock is on
• Wrong username
• Account locked after too many attempts

Solutions:

• Type slowly and carefully
• Check Caps Lock status
• Verify username is correct
• Wait if account is temporarily locked
• Request password reset if truly forgotten

Cannot Change Password

Problem: New password rejected during forced change.

Possible Causes:

• New password doesn't meet minimum requirements
• New password matches old password
• Confirmation doesn't match new password
• Special characters not supported

Solutions:

• Use at least 6 characters
• Make new password different from old
• Type confirmation exactly the same
• Avoid unusual special characters
• Try alphanumeric password

Employee Password Reset Not Working

Problem: Employee cannot log in with default password after reset.

Possible Causes:

• SSN wrong in system
• Employee number wrong
• Default password calculation incorrect

Solutions:

• Verify SSN is correct in employee record
• Confirm employee number (with leading zeros)
• Double-check default password formula
• Contact payroll processor for assistance

Compliance and Audit

Password Policy Compliance

Document Your Policy

• Write down password requirements
• Specify change frequency
• Define reset procedures
• Communicate to all users

Enforce the Policy

• Regular password changes
• No sharing between users
• Immediate removal of terminated user access
• Monitor compliance

Audit Trail

ProPay WEB tracks:

• Who logged in and when
• Failed login attempts
• Password reset dates
• Data entry by user

Review Regularly

• Check login reports monthly
• Investigate failed attempts
• Verify appropriate access patterns
• Address anomalies immediately

Security Incident Response

If password is compromised:

1. Reset password immediately
2. Review recent activity for that account
3. Check for unauthorized changes
4. Notify affected parties if needed
5. Document incident
6. Strengthen security measures
7. Additional training for users

Administrator Responsibilities

Creating Secure Users

When creating new users:

1. Verify user identity and authorization
2. Assign appropriate access level (least privilege needed)
3. Generate strong temporary password
4. Provide credentials securely (not email)
5. Force password change on first login
6. Document user creation in your records

Managing Password Resets

When users request resets:

1. Verify identity before resetting
2. Use approved verification method
3. Generate new temporary password
4. Provide securely
5. Confirm user successfully logged in
6. Document reset in your records

Monitoring Security

Regular security reviews:

1. Review login activity monthly
2. Investigate suspicious patterns
3. Disable inactive accounts
4. Update access rights as roles change
5. Audit admin account usage
6. Test password reset procedures

Related Topics

• Employer User Management
• Employee Portal
• Employer Portal
• Security Best Practices
• Troubleshooting Connections

← Back to Index