Cashier PIN security

Every sale, discount, override and drawer opening in Bitta Retail POS names a real person. This page shows how to give POS users their PINs, when a register asks for them, how the lock screen and auto-lock work, which actions need a supervisor's approval, and how PIN attempt limits and lockouts stop anyone from guessing a PIN.

Prerequisites

• The BAA POS - Admin permission set.
• POS users exist for your cashiers and supervisors. See Users.

Set a PIN

1. Open POS Users from the Setup menu of the Bitta Retail POS Admin role center and open the user.
2. Choose Setup -> Set PIN.

3. In the Set PIN dialog, enter the New PIN and choose OK. A PIN is 4 to 8 digits; anything else is refused with "PIN must be 4 to 8 digits (numbers only)."

4. PIN Set on the card and the list now shows the PIN as assigned.

The PIN is never stored or shown as plain text. Bitta Retail POS stores only a SHA-256 hash of the PIN salted with the POS user's record ID, in a separate credential table, and every change is written to the audit trail. To reset a forgotten PIN, run Set PIN again; there is no way to read the old one. An active user without a PIN cannot sign in at a register.

Shared-terminal login

PIN login when a register opens needs two switches together: Require Terminal Password on POS Setup (off by default) and Shared Terminal on the POS terminal. When both are on, the POS Terminal Login dialog asks for the Cashier and PIN before the register opens and before a POS Sale card can start a sale. The Cashier lookup lists the POS users allowed on that terminal.

A wrong PIN keeps the dialog open with "Invalid POS user or PIN. Attempts left: ...", and the typed cashier stays filled in. When the attempts are used up, the login fails and the lockout described below applies.

Lock screen and auto-lock

The Lock button on the register's status bar locks the register at once. The Register locked screen covers everything with a PIN pad: the current cashier unlocks with Unlock, and another cashier takes over with Switch cashier (Choose cashier when no cashier is preselected). New sales carry the new cashier's attribution, so a lock is also how a shared register changes hands mid-shift.

The register can also lock itself after idle time:

Setting	Values
Auto-Lock Register (min) on POS Setup	Company default. 0, the default, never locks.
Auto-Lock (min) on the POS terminal	-1 uses the POS Setup value, 0 never locks this register, 1 or more locks after that many idle minutes.

A register page that is closed without Close Register, for example when the browser tab is closed, keeps its claim on the register until Register Lease Timeout (sec) passes after the last heartbeat. The default is 120 seconds; use 60 to 600.

Supervisor approvals

Some actions need a second person. The Supervisor Approval dialog says "This action requires supervisor approval. Ask a supervisor to enter their POS User No. and PIN." Only a POS user with Supervisor selected can approve; any other valid user is refused with "POS user ... is not a supervisor." An approval applies to the one request it was given for.

Operation	When approval is asked
Line Discount, Invoice Discount	The discount is above the cashier's Max Discount % (or Default Max Discount %) and Supervisor For Over-Limit Discount is on.
Price Override	The cashier lacks Can Override Price and Supervisor For Price Override is on.
Sale Cancellation	A sale is cancelled from the POS Sale card while Allow Cashier Sale Cancel is off, or the sale belongs to another cashier.
Pricing Profile Switch	The pricing profile has Require Supervisor to Switch.

A cashier who is a supervisor is not asked to approve their own discounts and price overrides. Approval is an escape above a limit, not a way past a hard floor: a price below cost or below Min Margin % is refused for everyone. With Supervisor For Over-Limit Discount off, a discount above the cashier's limit is refused without an approval prompt. Day-to-day scenarios are in Supervisor approvals and Give discounts.

PIN attempt limits and lockouts

Three prompts accept a PIN: supervisor approval, shared-terminal login and register unlock. Each keeps its own count of wrong entries, governed by two POS Setup fields:

Field	Default	Meaning
Max PIN Attempts	3	Wrong entries allowed before the prompt locks. 0 allows unlimited retries.
Approval Lockout (min.)	15	How long a locked prompt stays locked after the last wrong entry, up to 10080 minutes (one week). 0 keeps it locked until an administrator clears it.

The count belongs to the Business Central user who is signed in, not to the POS user number typed into the dialog, so typing a different number does not reset it. On a register where several cashiers share one Business Central account, a lockout therefore applies to all of them until it ends. A count is cleared when the same POS user then authenticates correctly on that prompt, when the lockout time passes, or when an administrator clears it.

To end a lockout now, open POS Setup and choose Clear Approval Lockouts from the actions. It reports "Cleared ... POS approval lockout counter(s)." or "There are no POS approval lockouts to clear." POS Setup is administrator-only, so a cashier cannot clear their own lockout.

Wrong PINs, role refusals and PIN changes are recorded as audit evidence. For the reports that cover discounts, overrides and other controls, see All POS reports; POS user permissions covers the Business Central permission layer underneath.

What's next

Configure how sales are paid: Tender methods setup.