CardValet works with the most recent mobile operating software as well as two past generations of Android and iPhone devices.

Yes. There are multiple ways that a user can unsubscribe from CardValet. The user can unsubscribe through the CardValet application via Manage Portfolio. To unsubscribe, uncheck all cards and accounts and tap OK.

The app automatically logs the user off after 10 minutes of inactivity.

Yes. The new card number must be registered. The replacement card is added to the enrolled user’s profile via Menu>Manage Portfolio>Add Card. The old card cannot be removed but rather the user can unmanage the card via Manage Portfolio.

CardValet passwords must be at least 8 characters in length and must contain at least 1 upper case character, 1 lower case character, 1 number, and 1 special character.

The user must create a unique login account for each financial institution. Each login account is applicable for a single financial institution. In the login page, the logo of the last logged-in financial institution shows.

Yes. Cardholders can register multiple cards within a single CardValet app. Additional cards can be added within the Menu>Manage Portfolio>Add Card screen.

The user needs to enter the same level of detail entered for the original card. This information generally includes:

• Card Number
• Address
• ZIP code
• Expiration Date
• CVV/CVC Code

Secondary authentication includes:

• Security token sent in an email
• Last 4 digits of the social security number

Multiple individuals can register the same card as long as they know the card details. Typical examples of multiple individuals registering one card include: parents and dependents; spouses; and employers/employees.

The primary device is used to track the GPS for My Location alerts and controls and all merchant and threshold alerts will be sent to the primary device. All devices that have registered a particular card can view or change the CardValet settings for that card.

Controls (including the On/Off setting) are set at the card level, so the last update to a control will be honored regardless of which phone was used to make the change. Alerts are set at the device level, so each primary device will receive alerts that were set up from that particular device. The primary device can be re-set by accessing Settings>Primary Device.

Each person who registers a card will have access to controls for the card. In many cases, the employee will not know about CardValet unless the employer shares the information.

If the card number is new, then the user must add the new card number to the user’s profile. In addition, the user may unmanage the old card by accessing Manage Portfolio.

Yes. To activate an unsubscribed user, the user registers as a new user. The user is required to select a new user name; if the user enters their previous user name an error displays. Upon successful registration, the user may once again use CardValet.

The My Location controls and alerts will check to ensure the merchant location is within a 5-mile radius of the device set as primary within CardValet. These controls impact card present transactions only, therefore internet transactions are not impacted.

CardValet ignores location information that is more than 8 hours old. So, if the phone is off for more than 8 hours, My Location controls will not take effect, and the transaction will not be denied on the basis of the old location information.

CardValet performs a proximity check at the granularity of ZIP code or city, so if the merchant is close to home then the transactions will still go through.

The region shows the approximate area where the card can be used; the area must be greater than 5 square miles. CardValet can typically map the transaction down to a ZIP code or city. If the city or ZIP code of the merchant overlaps with the selected region in the map, then the transaction can still go through. There are instances where a merchant location cannot be mapped down to a ZIP code or city, in which case CardValet will default to a state-level match.

Yes. International transactions can be blocked using the Block International location control. Transactions will be limited to the United States.

No. The location controls are applicable to in-store transactions only.

Previously authorized recurrent payments will continue to process and will bypass the CardValet edit checks.

Specific merchant types have been created within CardValet, and these merchant types can be used for controls or alerts via the Alert Preferences or Control Preferences screen. Each of the merchant types contains various merchant category codes (MCC). Note: It is possible for a retailer to forward a MCC that may differ from the CardValet merchant type classification. Merchant types currently supported are: Department Store, Entertainment, Gas Station, Grocery, Household, Personal Care, Restaurant, Travel, and Others.

ATM transactions are categorized within Others merchant type.

The user can set the Do Not Disturb time that will suppress notification during the set time. Some notifications will still be delivered, for example any transaction denial or any transaction that is a card-present authorization.

No. The alerts are consolidated into one message. Example: if the message has violated Threshold and Location settings then you will see only one alert and not multiple alerts.

CardValet updates the balance under two conditions:

• When the user logs into CardValet
• When the user taps Refresh

Even if the balance has fallen below the threshold that has been set, it is only updated when the user logs into the app or taps Refresh, which then triggers the alert.

Yes. The app shows last 50 card-based transactions posted within last 30 days.

Some merchant types will preauthorize the card for an amount that may be larger than the actual transaction amount. In this instance the preauthorization amount must meet the threshold spend limit.

CardValet controls are only invoked during authorization of a transaction. In some cases, such as gas stations, a card may be tested for validity by doing a $1 preauthorization, and the actual transaction amount is charged to the card after the transaction.

Some gas stations will preauthorize for a maximum amount, example: $126, and some gas stations will check validating, example: $1. In the latter case, the actual transaction amount may exceed the limit, while in the former case, an authorization may be denied.

When a cardholder logs on to the CardValet application, a Balance Inquiry transaction is performed to retrieve and display the balance. A balance inquiry is performed on every account listed in the cardholder record. The application will not initiate more than one balance inquiry within 30 minutes even if the cardholder presses the Refresh button.

CardValet only shows the transactions that are performed with the card. It does not show the transactions that are done on the account but without using your card, such as teller transactions or bill pay on an account.

When a transaction is denied by the limit authorization check and not CardValet then in Transaction Journal the response code will be 015 (enter lesser amount) or 033 (exceeds transaction limit frequency).