Payment protection: your PIN, approved addresses and bank changes

A payment PIN, a lock to your website’s own server and email approval for every change, so nobody who gets into your admin or copies your licence key can charge cards, refund or move your payouts.

Booked Payments lets you move real money from your admin: charge a card a customer left with you, refund a payment, send your balance to your bank. Payment protection makes sure only the right people can. It adds a six-digit payment PIN, can lock money actions to your website’s own server, and sends every change to its settings, and every new payout bank, to the account owner to approve by email.

It guards against two things. Somebody signs in to your WordPress admin with a leaked password, or at a computer left unlocked. Or somebody copies your licence key, the key that connects your site to Booked, from a backup, a screenshot or a copied database. Either could otherwise charge your customers’ saved cards, send refunds out of your balance or point your payouts at a bank account of their own. It is part of Booked Payments, and never gets in your customers’ way. With your own Stripe connected, the PIN still guards connecting or disconnecting the account; the money itself, payouts, bank and refunds, lives in your Stripe dashboard under Stripe’s own controls.

What each part stops

You switch on the PIN and the address lock. Approval of a new bank, and the pause after it, apply to every Booked Payments account.

Where to find it

Open Payments, under System in the left-hand menu. The Payment protection card sits under Payouts and above Apple Pay & Google Pay.

• 1Off / On — reads On once a PIN or an address lock is in place. Approval of a new bank is always on, whatever this says.
• 2The account owner — their email address, partly hidden. Every change on this card goes to them to approve.
• 3Set a PIN — opens the dialog for a new PIN. Once a PIN is on, this becomes Change PIN, with Forgot it beside it.
• 4Your website’s address — the address Booked sees your website’s server calling from. It is not the address of the computer you are using.
• 5Lock to this address — asks to lock money actions to that address. Once the lock is on, it changes to Approve this address for an address not yet on the list, and disappears when the address is approved.

The buttons on this card act as soon as you press them; the Save button at the top of the screen has nothing to do with them. The card only appears once Booked Payments is live (see Setting up payments), not on your own Stripe, and only for owners and team members with Settings at Edit. If Booked cannot be reached, the card is simply missing until you reload.

Who approves changes

Every change on this card, and every new payout bank, waits for the account owner: the person whose Booked account holds your licence and signs in at trybooked.co/account (failing that, the email address on the licence). That need not be an owner on your Team screen. Any WordPress administrator can ask for a change, but only somebody who reads the account owner’s email can approve it.

How approval works

1. Ask for the changePress the button on the card, for example Set a PIN. If a PIN is already on, Booked asks for it first.
2. Booked emails the account ownerThe card says "We have emailed pr•••@meridianpharmacy.co.uk. The change happens when they open the link and press Approve." and lists the request under "Waiting for the account owner to approve:".
3. The owner opens the link and presses ApproveThe subject is "[Booked] Approve a change to payments". The link opens a page headed "Approve this change?", and nothing happens until somebody presses Approve, so an email scanner that opens links cannot approve by accident.
4. Reload the Payments screenThe page in the browser says Approved and what changed. The card in your admin does not update by itself.

• 1What was asked — the change, in plain words: "set a new payment PIN", "remove the payment PIN", "allow payments from the address…", "stop allowing payments from…", "allow payments from any address again", or a new bank account.
• 2The address it came from — for a request made in your admin, this is your website’s address, the same one the card shows. A different address is worth a second look; see If you did not ask for it below.
• 3The link — good for 24 hours, and for one approval only. The email is plain text, so the link may show as a long web address.
• 4Approve — the only thing that makes the change. There is no reject button: if you do not want it, close the page.

Each link works once, for 24 hours. After that it shows "That link has expired" and tells you to "Ask again from System › Payments in the Booked plugin." Ignore the email and nothing changes: the request drops off the card after 24 hours, and there is no other way to withdraw it. If the email cannot be sent, the card says "We could not send the approval email. Try again in a minute."

Set a payment PIN

1. Press Set a PINA dialog opens: Set a payment PIN.
2. Type six digits in New PIN and Same againThe fields take digits only, six at most, and show dots.
3. Press Send for approvalThe dialog closes and the card shows "We have emailed…".
4. Approve it from the emailThe page then reads "Your payment PIN is on. Booked asks for it before a card is charged, a payment refunded or a payout changed."

• 1The rules — six digits, not an easy run and not one digit repeated.
• 2New PIN and Same again — must match. "A payment PIN is six digits." or "The two PINs are not the same." appears under them if not.
• 3Send for approval — asks for the PIN; it does not switch it on. Nothing changes until the owner approves.

A PIN like 111111, 123456 or 654321 is turned down after Send for approval with "That PIN is too easy to guess. Avoid repeated digits and runs like 123456." The approval email is the only email about a PIN; nothing follows once it is approved.

There is one PIN for the whole site, not one per person. Share it only with the people who charge cards, give refunds or look after payouts. Booked keeps it scrambled on its own platform, never on your website, so nobody can look it up, Booked included.

To change it, press Change PIN. The dialog is titled Change your payment PIN. After Send for approval, Booked asks for the current PIN, then emails the owner. The old PIN works until the new one is approved.

What asks for the PIN

• Charging a card on file. Charge £… to the card on the bill with Card on file chosen, and Take the remaining £… on a booking. See Taking money at the till and Cards on file.
• Refunding to a card. Refund £… to the card in Payments › All payments, a booking’s Refund payment, Refund in the payments list on the Payments screen, and Yes, refund on a payment a bank has flagged as fraud. See Refunds.
• Payouts. Yes, send it after Pay out now, and Save schedule. See Payouts.
• Bank details. Save bank details on the Payouts card.
• Payment protection itself. Change PIN, Lock to this address, Approve this address, Remove and Turn off. Forgot it never asks.

Nothing else asks: not your customers paying online, not Cash or Card machine on the bill, not refunds that go back as cash or on your machine.

Entering the PIN

Booked tries the action first. When the PIN is needed, the Enter your payment PIN box opens over what you were doing.

• 1What it is for — the same box opens for every protected action, from a bill, a booking or System › Payments.
• 2PIN — digits only, six at most, shown as dots. It is empty each time the box opens.
• 3The wrong-PIN message — appears after a wrong try and counts down what is left. The box stays open and the field clears.
• 4Confirm — reads Checking… while Booked checks. Pressing Enter does the same. Cancel, the cross, Escape or a click outside the box drops the action.

When the PIN is right, the box closes and the charge, refund or payout carries on with its usual message. Booked asks every time: the PIN goes with that one request and is kept nowhere on your website. Cancel and nothing is charged, refunded or paid out.

When the PIN is refused

A wrong PIN shows in the box. Everything else appears where you pressed the button: on the bill, in the refund dialog, on the booking or on the Payouts card.

The lock. Five wrong PINs in a row, from anybody on your team, lock every protected action for 30 minutes, including changes on the card except Forgot it. A right PIN resets the count. Cash and card machine carry on. The account owner gets "[Booked] Payments locked after wrong PINs": "Five wrong payment PINs were entered for meridianpharmacy.co.uk, the last from 203.0.113.24. Charges, refunds and payouts are locked for 30 minutes." The card shows the lock too, with the time it ends.

Forgot your PIN

1. Press Forgot itThere is no “are you sure”: the email goes at once. Pressed it by mistake? Ignore the email.
2. Approve the removalThe email asks to "remove the payment PIN". Afterwards the page reads "The payment PIN is off. Set a new one from System › Payments in the Booked plugin."
3. Set a new PINPress Set a PIN and approve that too.

Forgot it works during a lock, and approving it lifts the lock. Between the two approvals there is no PIN at all, so set the new one straight away.

Approved addresses

Every computer on the internet has an IP address, a string of numbers such as 203.0.113.24 that says where a request came from, like a postal address. When anybody on your team presses Charge or Refund, it is your website, on its server at your web host, that asks Booked. Booked sees that server’s address, never your staff’s computer or phone. Lock money actions to it, and a copy of your key used anywhere else is refused.

1. Press Lock to this addressThe row shows your website’s address: "Your website talks to Booked from 203.0.113.24." Some servers have a longer address with colons in it; that works just the same.
2. Approve it from the emailThe email asks to "allow payments from the address 203.0.113.24". Then: "Payments now only run from the addresses you approved, including 203.0.113.24."

• 1On — a PIN, an address lock, or both, are in place.
• 2Change PIN and Forgot it — change asks for the current PIN; forgot does not.
• 3Turn off — asks to drop the address lock altogether. There is no Lock to this address button here because this website’s address is already approved.
• 4Approved addresses — every address money actions may come from. this website marks the one your site is using now.
• 5Waiting for the account owner to approve — requests whose email has gone but which nobody has approved yet. Each drops off after 24 hours.
• 6The confirmation — shows after each request. It confirms the email went, not that anything has changed.

• Approve this address appears when your website starts using an address not on the list. Some hosts send from more than one; approve each. Booked keeps the five most recently approved, so a sixth drops the oldest.
• Remove asks to "stop allowing payments from 198.51.100.7". Then: "That address can no longer run payments." Removing the last one turns the lock off: "That was the last approved address, so payments can run from any address again."
• Turn off asks to "allow payments from any address again", and clears the list: "Payments can run from any address again."

Staff working from home, on mobile data or at another branch notice nothing. Whatever device they use, the request still comes from your website’s server. Customers on the booking form are not affected either.

When your website moves

The lock only matters when your website itself changes address: a new host, a move to another server, or your host changing its addresses. Every card charge, card refund and payout is then refused with "Payments on this site only run from the addresses you approved…", and the account owner gets "[Booked] A payment request was refused": "Somebody tried to charge, refund or pay out on meridianpharmacy.co.uk from 192.0.2.45, which is not one of the addresses you approved, so it was refused." That email goes at most once an hour per address.

To fix it, open Payments: the card shows the new address with Approve this address. Press it and approve the email. Changes on this card can be asked for from any address, so a site that has moved can always ask. If your host cannot promise a fixed address, leave the lock off and rely on the PIN.

Changing your bank details

On the Payouts card, press Change bank, fill in Account holder, Sort code and Account number, and press Save bank details, giving the PIN if asked. The card says "We have emailed the account owner to approve the new bank. It changes when they press Approve, and payouts pause for 72 hours after." Until then the old account stays in place and keeps getting payouts.

Every Booked Payments account works this way, with or without a PIN, and so does adding a bank where there was none. Update details on your account at trybooked.co/account goes through the same approval and pause.

The email reads: "Somebody asked to send payouts to a new bank account ending 6819 (Priya Sharma), with payouts paused for 72 hours once it is approved, on meridianpharmacy.co.uk, from the Booked plugin (address 203.0.113.24)." The name in brackets is the account holder you typed; with none, it is left out. Check the last four digits and the name before you approve. Afterwards the page reads "Payouts now go to the account ending 6819. They are paused until 10 October 2026, so a change nobody meant to make can be caught." A second email, "[Booked] Your payout bank account changed", confirms it, gives the time the pause ends and says "If you did not approve this, contact Booked straight away."

If the bank turns the details down at that point, the page says "That did not go through" with the reason. The link is used up, so ask again.

The 72-hour pause

For 72 hours after a new bank is approved, nothing is paid out.

• 1The new account — already in place. Pay out now is gone until the pause ends.
• 2The pause note — says exactly when payouts start again.
• 3Only when I ask — this is the pause at work, not a change you made. The pill reads When you ask for the same reason. Booked puts your own schedule back when the pause ends.
• 4The same note on Payment protection — shown on every account during a pause, whether or not a PIN is set.

• Takings keep coming in. Customers pay as normal, and you can still charge saved cards and give refunds. The money waits in your balance.
• The schedule is locked. Save schedule is refused with "Payouts are paused until…", as is Pay out now on your account at trybooked.co/account.
• Then it all goes back. Booked restores the schedule you had, and the next payout goes to the new account.
• Another bank change restarts the clock. Approving one during the pause gives a fresh 72 hours.

If you did not ask for it

• An approval email you did not expect. Do not press Approve; nothing changes. Look at the address in it. If it is your website’s, as shown on the card, somebody in your admin asked: check the Team screen and change your passwords. Any other address means somebody has a copy of your licence key.
• Your key may be out. Sign in at trybooked.co/account and press Rotate key. "The current key stops working immediately," so paste the new key into Settings › Your plan on your website straight away.
• "A payment request was refused." The address lock stopped somebody. Unless your website has just moved, rotate your key.
• "Payments locked after wrong PINs." If nobody on your team was struggling with the PIN, rotate your key and set a new PIN.
• "Your payout bank account changed" and you did not approve it. Contact Booked support straight away; nothing is paid out for 72 hours. Somebody may also be in the account owner’s email, so change that password too.

Who can do what

Without the Refunds tick, a booking’s Refund payment is refused with "Giving money back needs the Refunds permission. Ask the account owner." An API key can never refund, whatever its access. Owners on the Team screen are your WordPress administrators. They have full access but still need the PIN like everybody else. See Team access.

Common questions

Can each member of staff have their own PIN? No, there is one for the site. When somebody who knew it leaves, change it. If nobody remembers it, use Forgot it: Booked cannot read it back.

I approved the change but the card still says Off. Reload the Payments screen. The card only fetches its state when the screen opens.

Does the approval link need me to sign in? No. Whoever opens it can press Approve, which is why it only goes to the account owner. Keep that inbox secure and do not forward these emails.