That was also the case for a number of ACH portal softwares sold alongside retail POS suites in the 2000s. Instead of temporary storage until batching, full transaction details were held permanently by default.<p>At any time, anyone with access to a payment terminal who knew where to look could process transactions manually from these records. They could have double charged and skimmed, done reversals for a cut, or copied and sold customer profiles with CC numbers. These were BSA products marketed to small and medium sized businesses, so no one questioned compliance.