That was also the case for a number of ACH portal softwares sold alongside retail POS suites in the 2000s. Instead of temporary storage until batching, full transaction details were held permanently by default.

At any time, anyone with access to a payment terminal who knew where to look could process transactions manually from these records. They could have double charged and skimmed, done reversals for a cut, or copied and sold customer profiles with CC numbers. These were BSA products marketed to small and medium sized businesses, so no one questioned compliance.