SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 1 SHAZAM BOLT$ Reference Guide This guide is intended for SHAZAM issuing financial institutions participating in SHAZAM BOLT$, and for SHAZAM financial institutions whose cardholders receive funds from SHAZAM BOLT$ cardholders. SHAZAM BOLT$, page 3 Integrating SHAZAM BOLT$ Into Your App or Web Portal 4 System Requirements for BOLT$ App 4 Authentication and Security, page 5 Cardholder Authentication 5 Device Security 5 Card Registration 6 Cardholder Enrollment, page 7 Login, page 12 Before Login 12 After Login 16 Features, page 17 Menu 17 Home — Cards & Balances 18 Send Money (BOLT$ P2P Payments) 25 Manage Recipient 32 User Profile 34 Login Preferences 35 User Settings 37 ATM Locator 43 About 44 Help 44 Feedback 45 Log Out 45 Troubleshooting, page 46 Card Use When a Card is Blocked 46 Forgot Username 47 Forgot Password 48 Handling Hot-Card Situations 48 On-Screen Error Messages 50 Cardholder Requests Made Via Text Message 51 Notification Options 52

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 2 Activity Limits, page 54 Card Limit 54 Maximum P2P Daily Send Limit 54 Anti-Money Laundering (AML) Limit 55 PIN-Authentication Threshold Amount 56 Sample Email and Text Message Verbiage, page 57 Transaction Alerts 57 Suspicious Transaction Alerts 62 SHAZAM BOLT$ Notifications 64 SHAZAM BOLT$ Person to Person (P2P) Emails 72 Manage BOLT$ in SHAZAM Access, page 79 Functionality 79 Researching Transactions, page 82 Identify BOLT$ Balance Inquiries in SHAZAM Access Transaction Detail 82 Identify BOLT$ P2P Transactions in SHAZAM Access Transaction Detail 82 Identify BOLT$ Transaction Control Maintenance in SHAZAM Access Transaction Detail 83 SHAZAM BOLT$ Denials in SHAZAM Access 84 Using SHAZAM Reports, page 85 AML SHAZAM BOLT$ Activity (CD400-R) Report 85 Card Account File Maintenance (CD200-R) Report 85 Cardholder Institution Activity (SSR110) Report 85 Establisher Exception Journal (SSR105) Report 85 Establishing Institution Activity (SSR120) Report 85 Institution Settlement Summary (SSR130) Report 85 Mobile Activity (CM401-D) Report 86 SHAZAM Risk Management (FD020-R) Report 86 SHAZAM Security / Fraud Activity (SCD020) Report 86 Temporary Card Block (FW310-R) Report 86 Settlement and Balancing for P2P Transactions, page 87 Cardholder Reports and Settlement 87 Terminal Reports and Settlement 87 Change Log, page 88

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 3 SHAZAM BOLT$ The SHAZAM® BOLT$™ service allows participating financial institutions to provide online and mobile card-management services to their cardholders. BOLT$ allows the cardholders of participating financial institutions to do the following: • View balance information for the primary account for each registered debit card. • Set up alerts for the following transactions, which are received via text (SMS) message, email, or both (additional fees are charged to the issuing financial institution for text messages): • Suspicious transactions (if your institution subscribes to SHAZAM Fraud Management Services) • Transactions over a cardholder-configurable amount • Internet and phone transactions (card-not-present) • Transactions outside the U.S.

• Set up blocks for the following transactions: • All transactions (temporary card block) • Transactions over a cardholder-configurable amount • Internet and phone transactions (card-not-present) • Transactions outside the U.S. Note: Your cardholder can remove only blocks they’ve placed. Cardholders can’t remove a block placed by your financial institution or SHAZAM. • Send money to any cardholder if your financial institution subscribes to BOLT$ person-to-person (P2P) payments (mobile app only).

Regardless of whether your financial institution participates in BOLT$, all users of the SHAZAM BOLT$ mobile app can: • Receive money from BOLT$ cardholders.

• Locate the ATMs closest to them. SHAZAM provides the following methods for cardholders to access BOLT$: • The SHAZAM BOLT$ web portal (http://bolts.shazam.net/) allows cardholders to access BOLT$ through a web browser on a PC, laptop, or mobile device. The web portal supports the following web browsers: • Mozilla Firefox® • Windows® Internet Explorer® • Apple Safari® • Google Chrome™ • SHAZAM BOLT$ mobile app allows cardholders to access BOLT$ from mobile devices. Mobile app is available for free download for the following types of mobile devices: • SHAZAM BOLT$ for Apple® iOS®: available on the Apple App Store (https://itunes.apple.com/us/app/shazambolt$/id571486405).

• SHAZAM BOLT$ for Android™: available on Google Play™ (https://play.google.com/store/apps/details?id=net.shazam.bolt&hl=en).

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 4 Integrating SHAZAM BOLT$ Into Your App or Web Portal SHAZAM also provides a BOLT$ Application Programming Interface (API). Financial institutions can use the BOLT$ API to integrate BOLT$ account alerts and account blocking into their own web portals and mobile apps. For more information about the BOLT$ API, contact your account executive. System Requirements for BOLT$ App The BOLT$ app is supported on the following smartphone operating systems: • Android 6.0 and higher • iOS 10.0 and higher The BOLT$ app is supported on all devices that support these operating systems.

The BOLT$ app is optimized for smartphones but will also work on iPads and Android tablets. Fingerprint login is supported on an Android device only if the device supports the standard Android fingerprint authentication API. Login with Face ID® is supported on all Apple devices with Face ID, and login with Touch ID® is supported on all Apple devices with Touch ID.

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 5 Authentication and Security BOLT$ is available to your cardholders with POS-enabled debit cards. If a card can be used to make purchases, then it’ll work with BOLT$. Cardholder Authentication To offer BOLT$ to your cardholders, your financial institution must use one of the following authentication methods: • PIN-based authentication — SHAZAM or your online processor is able to perform PIN verification without receiving the Track 2 data located on the magnetic stripe of the card. • Plastics-based authentication — This process validates the last four digits of your cardholder’s Social Security Number (SSN) with his or her Primary Account Number (PAN) and the expiration date of the card.

Note: This product isn’t supported for ATM-only cards and savings-only cards. Additionally, if a card can be used to access more than one demand deposit account (DDA) or savings account, only the primary account is available. Device Security The BOLT$ app: • Certifies a mobile device’s ability to fully encrypt and secure cardholder information. • Enables a cardholder to create a unique username and password when signing up to use BOLT$. • Allows a cardholder to enable fingerprint login for the cardholder’s BOLT$ user account, if the device uses fingerprints for device security.

• Doesn’t store the cardholder’s password, Social Security number (SSN) or financial institution account information on the mobile device.

• Doesn’t send fingerprint information from the mobile device to SHAZAM. If your cardholder purchases a new mobile device and / or changes service providers, he or she must download BOLT$ to the new mobile device from the Apple App Store or Google Play Store. Note: Once BOLT$ is downloaded to a new device, the cardholder will log in to the app using his or her existing username and password to authenticate the new device. The cardholder can then enable fingerprint login, if the device uses fingerprints for device security. Cardholders must change their password after every 365 days. If a cardholder’s password has not been changed within the past 365 days, the password expires and fingerprint login is disabled on the cardholder’s mobile device.

When a cardholder logs in to BOLT$ with an expired password, the cardholder is prompted to change the password before continuing.

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 6 Card Registration At card registration, SHAZAM: • Validates the bank identification number (BIN) is eligible for BOLT$ and additional services, such as BOLT$ P2P. • Validates the card is active and the current card expiration date matches to that on file. • Ensures the PAN matches the plastics record. • Compares the last four digits of the cardholder’s SSN to the PAN’s plastics record, if applicable. • Verifies the PIN via an interactive voice response (IVR) call, if applicable. Note: If a cardholder of a non-BOLT$ issuer creates a BOLT$ account to receive money, SHAZAM ensures the PAN is the correct number of digits in length, has the correct check digit, and has an expiration date in the future.

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 7 Cardholder Enrollment To enroll in BOLT$, follow the steps below. Note: These screenshots are from an iPhone. The Android app is similar to the iPhone app in appearance and function. The web portal provides similar function to the mobile apps apart from mobile-only functions such as text alerts and biometric security. Step Screen 1. Download BOLT$ for free from the Apple App Store or Google Play Store. Or, access the SHAZAM BOLT$ web portal (http://bolts.shazam.net/).

2. Tap Register.

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 8 3. Use either of the following methods to enter your card number and expiration date: • Tap Capture Card to take a picture of your debit card using the device's camera. (The app must have access to the device's camera.) • Enter the card number and expiration date manually. After you enter the card number and expiration date, enable I accept Terms & Conditions and tap Next to continue. To read the terms and conditions before you accept them, tap the Terms & Conditions link to view the Terms & Conditions screen. Tap Done on the Terms & Conditions screen to continue cardholder enrollment.

Step Screen

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 9 4. Confirm the card is yours by entering additional information associated with your card. The information you enter depends on your financial institution's BIN settings. • Plastic-based authentication: Enter the last four digits of your Social Security number. • PIN-based authentication: Enter a phone number where you can be reached now. Verify the card number and expiration date and tap Next to continue. If the financial institution uses PIN-based authentication, an automated system calls the number that you entered.

When you receive this call, enter the card's PIN when prompted.

Note: If the information that you enter doesn’t match the information on file with SHAZAM, you are prompted to enter the correct information. If the second attempt is unsuccessful, you will not be able to try again until midnight. Step Screen

SHAZAM BOLT$ Reference Guide - SHAZAM BOLT$, page 3

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 10 5. Enter the following information for the user profile and tap Next. • Username • Password, Confirm Password Passwords must be between 5 and 32 characters long. Passwords must also contain at least one uppercase letter, one lowercase letter, one number and one special character , or *).

Your password expires if you do not change it within 365 days. • Primary Email The primary email address must be unique. For example, a husband and wife who share an email address can establish only a single BOLT$ account. • Mobile Number Note: An asterisk (*) indicates a mandatory field that needs to be entered.

6. Enter the following details and tap Next. • First Name, MI (Middle Initial), Last Name • Address • City • State • Zip Code Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 11 7. Tap Done to return to the login screen. SHAZAM sends you an email at your primary email address to confirm that the email address is valid. Tap the activation link in the email to activate your account before you login for the first time. If you attempt to log in without tapping the activation link in the email, the app prompts you to activate your account before you proceed, and SHAZAM sends you another email at your primary address with a new activation link.

You can log in successfully only after tapping the activation link in the latest email from SHAZAM.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 12 Login Immediately before and after logging in to BOLT$, you are presented with several options, as described below. Step Screen Before Login From the login screen, tap the following options: • Use Face ID, Use Touch ID or Use Fingerprint If biometric login is enabled in the app, a button that indicates the biometric login type is displayed. Supported types of biometric login include Face ID, Touch ID and fingerprint login on Android devices.

A more detailed explanation of these features follows.

• Forgot Username See Troubleshooting for details. • Forgot Password See Troubleshooting for details. • Quick Balance A more detailed explanation of this feature follows. • Register (For New Mobile Card User) See Cardholder Enrollment for details. • ATM Locator See Features for details. Select Remember Me to set the device to remember the username. Disabling Remember Me or entering a different username will automatically disable the Quick Balance and biometric login features.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 13 Biometric login (Face ID, Touch ID or fingerprint) Enabling Biometric Login During First Login BOLT$ suppors biometric login on devices on which you have enabled biometric login (Face ID, Touch ID or fingerprint login on Android devices). The first time that you use BOLT$ on a device on which biometric login is enabled, you must log in with your username and password. After you successfully log in, the prompt for the supported method of biometric login is displayed. • To enable biometric login in BOLT$, scan your fingerprint (for Touch ID or fingerprint security on Android) or your face (for Face ID).

You might also need to grant permission for BOLT$ to use the device’s camera or biometric login feature.

• To continue without enabling biometric login in BOLT$, tap Cancel. Note: This method for enabling biometric login is available only the first time you log in after installation. To enable biometric login after the first login, you must log in with your username and password and tap Menu > Login Preferences. Login with Fingerprint (iPhone 8 and below or Android) If fingerprint login is enabled in the app, the app displays the fingerprint prompt automatically when you launch the app. Scan your fingerprint to log in with the username that is saved on the device, or tap Cancel to sign in with a different username and password.

If you make three consecutive unsuccessful attempts to access the account with a fingerprint, fingerprint login is disabled. To enable fingerprint login again, you must log in with your username and password and tap Menu > Login Preferences.

If the fingerprint prompt does not display, tap the fingerprint button on the login screen (Use Touch ID or Use Fingerprint) to access the fingerprint prompt. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 14 Login with Face ID (iPhone X and above) If Face ID login is enabled in the app, the app displays the Face ID prompt automatically when you launch the app. Scan your face to log in with the username that is saved on the device, or tap Cancel to sign in with a different username and password. If the Face ID prompt does not display automatically, tap Use Face ID on the login screen to access the Face ID prompt.

Quick Balance If the Quick Balance feature is enabled on a device, you can tap Quick Balance on the login screen to view the balance on all cards associated with your BOLT$ account.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 15 The Quick Balance feature shows only cards that are issued by BOLT$ financial institutions. If there are no such cards registered in your BOLT$ account, Quick Balance displays No eligible cards found. If the Quick Balance feature is disabled in the app, you cannot see the balances for the eligible cards. To enable Quick Balance, log in and tap Menu > Login Preferences. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 16 After Login After you access the account, the app displays the Cards & Balances screen, which is the home screen of the app. You return to the Cards & Balances screen whenever you tap Menu > Home. The Cards & Balances screen displays all cards that are registered in the BOLT$ account, even if the cards are from two or more financial institutions. More details on these options are included in Features. When no cards are registered in the BOLT$ account, the Card & Balances screen displays no cards.

Note: If your BOLT$ account doesn’t contain a card, and you don’t log in for six months, the account is considered dormant and is purged. You must create a new account to use BOLT$ again. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 17 Features After enrolling in BOLT$, there are a number of different features you can use. Step Screen Menu Access the menu by tapping the menu button. Your username is displayed on the menu before any menu options. The menu options include: • Home • Send Money • Manage Recipient • User Profile • Login Preferences • User Settings • ATM Locator • About • Help • Provide Feedback • Log Out Send Money and Manage Recipient are available only if the account has at least one card issued by a BOLT$ P2P financial institution.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 18 Home — Cards & Balances When you tap Menu > Home, the app displays the Card & Balances screen. The Cards & Balances screen can show the following details for each registered card. • Financial institution name • Last four digits of PAN • Available Balance — The amount of money in an account that’s available for immediate withdrawal or other type of use. It represents the difference between the account balance and any activity that hasn’t yet cleared on the account (such as pending deposits, checks and withdrawals).

Financial institutions sometimes put a hold on deposited checks to ensure their legitimacy, and the holds can last for as much as a week on larger deposits. • Ledger Balance — The actual balance on the account at the start of the business day. It's the balance that’s printed on financial statements. This is the balance that’s used to calculate interest payments on interest-bearing accounts. It's also the figure that’s used to figure out whether balance requirements have been met on certain types of accounts. It doesn't include pending activity. Note: Please refer to your financial institution’s balance-type definitions when discussing this information with cardholders.

BOLT$ displays card balances only for cards issued by a BOLT$ financial institution. If a card is not issued by a BOLT$ financial institution, the Cards & Balances screen displays NA as the balance. If you have such a card, you can only receive money on the card, change the card’s expiration date or delete the card. A card balance is blank if the card is issued by a BOLT$ financial institution but the balance is unavailable or can’t be displayed for any reason. You can tap a card to view Card Actions for that card. You can also tap Add Card to add a card to the BOLT$ account. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 19 Card Actions When you tap a card on the Cards & Balances screen, Card Actions are displayed for the card. The top of the screen shows detailed information about the card: • Last four digits of PAN • Financial institution logo or name and ABA number • Balance information when available • Valid Thru (expiration date) Tap Terms & Conditions to view the terms and conditions that are applicable to the card.

From Card Actions, you can perform the following actions: • Set alerts (if the card issuer subscribes to BOLT$). See “Set Alerts/Set Alerts & Blocks” on page 20. • Set blocks (if the card issuer subscribes to BOLT$ transaction control). See “Set Alerts/Set Alerts & Blocks” on page 20. • Send money to other cardholders (if the card issuer subscribes to BOLT$ P2P). See “Send Money (BOLT$ P2P Payments)” on page 25. • Change the card’s expiration date. See “Change Expiration Date” on page 24.

• Remove the card from the BOLT$ account. See “Remove Card” on page 24. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 20 Set Alerts/Set Alerts & Blocks You can use BOLT$ to set card activity alerts and to block certain types of card activity. Certain features can be used only if the card issuer subscribes to these features. • If the card issuer subscribes to BOLT$ but not to BOLT$ transaction control, Card Actions displays the Set Alerts button. Tap this button to view the Set Alerts screen, from which you can set alerts for the card.

• If the card issuer subscribes to BOLT$ transaction control, Card Actions displays the Set Alerts & Blocks button. Tap this button to view the Set Alerts & Blocks screen, from which you can set alerts and blocks for the card. Block-related options are displayed on the Set Alerts & Blocks screen but not on the Set Alerts screen. Otherwise, these screens are identical. Alerts can be sent as emails. If the card issuer subscribes to BOLT$ text messaging, text alerts can also be sent as text (SMS) messages for all alert types other than BOLT$ notifications. Tap the Turn Card Off / On switch to place or remove a temporary card block.

A temporary card block halts transaction activity on a card while an issue is being resolved. For example, a temporary card block can be placed on a card if the card is misplaced. The Turn Card Off / On switch does not indicate whether your financial institution or SHAZAM have placed their own card blocks on your card, and you cannot use this switch to remove such card blocks from your card.

You may manage alerts or blocks for the following types of activity by tapping the option for that activity: • Transaction over a cardholder-configurable amount • Internet and phone transactions (card-not-present) • Transactions outside the U.S. You may manage alerts for the following types of activity by tapping the option for that activity: • Suspected fraud alerts (configurable only if your institution subscribes to SHAZAM Fraud Management Services) • SHAZAM BOLT$ email notifications for BOLT$ account setting updates Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 21 Set alerts & blocks based on transaction amount On the Set Alerts screen or the Set Alerts & Blocks screen, tap Transaction Amount to manage alerts for purchases that exceed a card-specific, user-defined amount. If the card issuer subscribes to BOLT$ transaction control, you can also set BOLT$ to block purchases that exceed a card-specific, user-defined amount. You can receive email alerts at your profile's primary and secondary email addresses, which are displayed here. If the card issuer subscribes to BOLT$ text messaging, your profile’s mobile number is displayed here, and you can receive text (SMS) alerts at your profile's mobile number.

To receive alerts for purchases over a specified amount, enter the amount under Alerts and enable the switches for the email addresses or mobile number at which you want to receive the alerts. If you enable the mobile number switch and tap Submit, BOLT$ must verify your mobile number if it has not yet done so. For more information about this requirement, see Mobile number verification. To block purchases over a specified amount, enter the amount under Blocks and enable the Blocks switch. You can edit the profile’s secondary email address here. If you edit the secondary email address, SHAZAM sends you an email at the specified secondary email address to confirm that the email address is valid.

You must tap the activation link in the email before the secondary email address change takes effect. Mobile number verification If you enable text (SMS) message alerts in the app, the app must verify that you can receive text messages at your profile’s mobile number. Verification is needed only the first time that you enable text message alerts. The app will not need to verify your mobile number again unless you change your mobile number. To verify the mobile number, the app displays the terms and conditions for text alerts, and SHAZAM sends a text message with an activation code to your mobile number.

Review the terms and conditions, enter the activation code into the app when prompted, and tap Submit.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 22 Set alerts & blocks based on internet & phone transactions On the Set Alerts screen or the Set Alerts & Blocks screen, tap Internet & Phone Transactions to manage alerts for internet and phone purchases using the card. If the card issuer subscribes to BOLT$ transaction control, you can also set BOLT$ to block internet and phone purchases using the card. You can receive email alerts at your profile's primary and secondary email addresses, which are displayed here.

If the card issuer subscribes to BOLT$ text messaging, your profile’s mobile number is displayed here, and you can receive text (SMS) alerts at your profile's mobile number.

To receive alerts for internet and phone purchases, enable the switches for the email addresses or mobile number at which you want to receive the alerts. If you enable the mobile number switch and tap Submit, BOLT$ must verify your mobile number if it has not yet done so. For more information about this requirement, see Mobile number verification. To block internet and phone purchases, enable the Blocks switch. You can edit the profile’s secondary email address here. If you edit the secondary email address, SHAZAM sends you an email at the specified secondary email address to confirm that the email address is valid.

You must tap the activation link in the email before the secondary email address change takes effect. Set alerts & blocks based on transactions outside U.S.

On the Set Alerts screen or the Set Alerts & Blocks screen, tap Transactions Outside U.S. to manage alerts for purchases made outside the United States using the card. If the card issuer subscribes to BOLT$ transaction control, you can also set the BOLT$ to block purchases made outside the United States using the card. You can receive email alerts at your profile's primary and secondary email addresses, which are displayed here. If the card issuer subscribes to BOLT$ text messaging, your profile’s mobile number is displayed here, and you can receive text (SMS) alerts at your profile's mobile number.

To receive alerts for purchases made outside the U.S., enable the switches for the email addresses or mobile number at which you want to receive the alerts. If you enable the mobile number switch and tap Submit, BOLT$ must verify your mobile number if it has not yet done so. For more information about this requirement, see Mobile number verification. To block purchases made outside the U.S., enable the Blocks switch. You can edit the profile’s secondary email address here. If you edit the secondary email address, SHAZAM sends you an email at the specified secondary email address to confirm that the email address is valid.

You must tap the activation link in the email before the secondary email address change takes effect. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 23 Set alerts based on suspected fraud alerts On the Set Alerts screen or the Set Alerts & Blocks screen, tap Suspected Fraud Alerts to manage alerts for suspected fraudulent purchases made using the card. (These alerts are available only if the card issuer subscribes to SHAZAM Fraud Management Services.) You always receive suspected fraud alerts at your profile’s primary email address. You can choose to receive email alerts at your profile's secondary email address. For reference, your profile’s primary and secondary email addresses are displayed here.

If the card issuer subscribes to BOLT$ text messaging, your profile’s mobile number is displayed here, and you can receive text (SMS) alerts at your profile's mobile number. To receive alerts for suspected fraudulent purchases at your profile’s secondary email address or mobile number, enable the switches for the secondary email address or mobile number. If you enable the mobile number switch and tap Submit, BOLT$ must verify your mobile number if it has not yet done so. For more information about this requirement, see Mobile number verification.

You can edit the profile’s secondary email address here. If you edit the secondary email address, SHAZAM sends you an email at the specified secondary email address to confirm that the email address is valid. You must tap the activation link in the email before the secondary email address change takes effect. Set alerts for SHAZAM BOLT$ notifications On the Set Alerts screen or the Set Alerts & Blocks screen, tap SHAZAM BOLT$ Notifications to manage alerts for BOLT$ account setting updates. You can receive email alerts at your profile's primary and secondary email addresses, which are displayed here.

To receive alerts for BOLT$ account setting updates, enable the switches for the email addresses at which you want to receive the alerts.

You can edit the profile’s secondary email address here. If you edit the secondary email address, SHAZAM sends you an email at the specified secondary email address to confirm that the email address is valid. You must tap the activation link in the email before the secondary email address change takes effect. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 24 Change Expiration Date If you are reissued a debit card with a new expiration date, and the debit card isn’t a SHAZAMChek card, you must change the expiration date of the card manually before it expires.

To change the expiration date of a card: 1. Tap the card on the Cards & Balances screen. 2. Tap Change Expiration Date under Card Actions 3. Enter the new expiration date and tap Submit. The expiration dates of SHAZAMChek cards are updated automatically after card activation, although you might need to wait until the next day for the update to take effect. Remove Card To remove a card from your BOLT$ account: 1. Tap the card on the Cards & Balances screen. 2. Tap Remove Card under Card Actions. 3. Tap Confirm.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 25 Send Money (BOLT$ P2P Payments) Send Money To New Recipient If your financial institution is enrolled in BOLT$ P2P, you can send money to other BOLT$ users. If you have not yet sent a BOLT$ P2P payment to a specific recipient, follow these steps. To send a BOLT$ P2P payment to a new recipient: 1. Complete one of the following actions: • From the Cards & Balances screen, tap the card from which you want to send money, then tap Send Money under Card Actions.

The Send Money screen is displayed. • Tap Menu > Send Money, then tap Choose Card and select the card from which you want to send money. 2. Tap Add New Recipient. The Choose Existing Recipient field becomes the New Recipient field.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 26 Step Screen 3. Enter the new recipient’s email address into New Recipient and tap Next. BOLT$ verifies whether the email address is registered to an existing BOLT$ account with a valid, active card. • If the recipient is registered - BOLT$ uses the existing BOLT$ account and continues to the next step. • If the recipient is not registered - An error prompt is displayed. When you tap OK, BOLT$ sends a registration request email to the email address you entered, inviting the recipient to register for BOLT$ and enroll a card to receive money.

The invitation email gives the recipient a deadline of five days to register. On the fourth day, a reminder email is sent. If the recipient registers - You receive an email stating the payment can be initiated. Log in to the app and re-start this procedure again from the beginning. If the recipient doesn’t register - You receive an email stating the recipient has not registered. The payment can’t be completed. 4. Enter a new nickname for the recipient and the amount to send to the recipient. A minimum amount of $1 is required. Enter the amount as dollars and cents without a decimal. For example, to send $15 enter 1500.

You can also enter an optional comment about the transaction. For example, you can state what the money is for. Note: The receiver will see the memo in the email that he or she receives. The character limit for the memo is 200. If your financial institution charges a fee to send a payment, the fee does not count toward your maximum BOLT$ P2P daily limit. 5. Tap Next.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 27 6. Complete the remaining fields on the Review & Send screen and tap Send. • You must enter a recipient nickname for a new recipient.

The nickname can be the recipient’s real name or a name the user calls the recipient. • If the payment amount is over the PIN-threshold amount limit, you are required to enter a callback telephone number. When you tap Send, an automated system will call the number that you enter. When you receive this call, enter the card's PIN when prompted.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 28 7. After you tap Send, the confirmation screen is displayed. The screen summarizes the transaction that’s just been completed. Both parties will receive an email confirmation of the BOLT$ P2P payment. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 29 Send Money To Existing Recipient If your financial institution is enrolled in BOLT$ P2P, you can send money to other BOLT$ users.

Follow these steps to send a BOLT$ P2P payment in either of the following cases: • You have previously sent a BOLT$ P2P payment to the intended recipient. • You used BOLT$ to send a registration request email to the intended recipient, and you received an email stating that the recipient accepted the request and completed registration.

If you have not yet sent a BOLT$ P2P payment to a recipient, follow the steps under “Send Money To New Recipient” on page 25. To send a BOLT$ P2P payment to an existing recipient: 1. Complete one of the following actions: • From the Cards & Balances screen, tap the card from which you want to send money, then tap Send Money under Card Actions. The Send Money screen is displayed. • Tap Menu > Send Money, then tap Choose Card and select the card from which you want to send money. 2. Tap Choose Existing Recipient. A list of active and inactive users is displayed. Only active users can receive money.

Inactive users do not have a valid card registered within SHAZAM BOLT$, so they cannot receive money. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 30 3. Tap the recipient and tap Next. 4. Enter the amount to send to the recipient. A minimum amount of $1 is required. Enter the amount as dollars and cents without a decimal. For example, to send $15 enter 1500. You can also enter an optional comment about the transaction. For example, you can state what the money is for. Note: The receiver will see the memo in the email that he or she receives. The character limit for the memo is 200. If your financial institution charges a fee to send a payment, the fee does not count toward your maximum P2P daily limit.

5. Tap Next. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 31 6. Review the payment information on the Review & Send screen and tap Send. If the payment amount is over the PIN-threshold amount limit, you are required to enter a callback telephone number. When you tap Send, an automated system will call the number that you enter. When you receive this call, enter the card's PIN when prompted. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 32 7. When you tap Send, the confirmation screen is displayed. The screen summarizes the transaction that’s just been completed. Both parties will receive an email confirmation of the P2P payment. Manage Recipient If your financial institution subscribes to the BOLT$ P2P service, the following options are available when you tap Menu > Manage Recipient: • Add Recipient • Edit Recipient • Delete Recipient Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 33 Add Recipient To add a P2P payment recipient: 1. Tap Menu > Manage Recipient. 2. Tap Add Recipient. 3. Enter an email address and a nickname for the recipient. The nickname can be the recipient’s real name or a name the user calls the recipient. 4. Tap Add. Edit Recipient To change the nickname of a P2P payment recipient: 1. Tap Menu > Manage Recipient. 2. Tap Edit Recipient. 3. Select the recipient whose nickname you want to change. 4. Edit the nickname as desired and tap Submit. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 34 Delete Recipient To delete a P2P payment recipient: 1. Tap Menu > Manage Recipient. 2. Tap Delete Recipient. 3. Select the recipient to delete. 4. Tap Delete. User Profile You can update your BOLT$ user profile information (such as name, address, mobile number, and email addresses). If you change any of the information in your user profile, an email is sent to your primary email address to confirm the change. If you change either of your profile’s email addresses, an activation email is sent to the changed email addresses. You must tap the link in the activation email before the change takes effect.

When the change takes effect, BOLT$ disables any alerts that go to your email addresses apart from alerts that always go to your primary email address (such as user profile change alerts and suspected fraud alerts). To continue to receive those alerts, you must re-enable the alerts.

If you change your mobile number, BOLT$ disables any text alerts that go to your mobile number. To continue to receive those alerts, you must re-enable the alerts. You must also verify your new mobile number the first time that you enable text alerts in the app. To update your BOLT$ user profile information: 1. Tap Menu > User Profile. 2. Change the information in your user profile and tap Save. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 35 Login Preferences Tap Menu > Login Preferences to view the Login Preferences screen.

Use the settings on this screen to set login preferences for the mobile app. • Enable Quick Balance to view the current account balances without having to log in. A user must enable Remember Me to use Quick Balance. • Enable Remember Me so that the device remembers the username. • Enable Log In with Fingerprint or Log In with Face ID to use biometric login to access the app. The name of this option depends upon the type of biometric login that is available on the device (fingerprint for Touch ID and Android devices, Face ID for Face ID devices). You must enable biometric login on the device before you can enable biometric login in the app.

Also, you must enable Remember Me to use this option.

Quick Balance When you enable Quick Balance in the BOLT$ app, the app allows users of the device to view account balances without having to log into the app. Only the balances of cards issued by BOLT$ financial institutions can be viewed using Quick Balance. Enabling this option also enables Remember Me because Remember Me is required for this option. When you enable this feature on the Login Preferences screen, the app displays a prompt to explain what this feature does. Tap OK to close the prompt. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 36 Remember Me When you enable Remember Me in the BOLT$ app, the app remembers the current authenticated username. The next time that you log into BOLT$, the app fills in the Username field on the login screen with this username. Remember Me is required for Quick Balance and for any type of biometric login (Face ID, Touch ID, or fingerprint login on Android). If you disable Remember Me on the Login Preferences screen, the app displays a confirmation dialog to notify the user that these features will be disabled. Tap OK to disable Remember Me or Cancel to return to the Login Preferences screen without disabling Remember Me.

This confirmation dialog is not displayed if you disable Remember Me on the login screen.

Log In with Face ID/Fingerprint Enable Log In with Fingerprint or Log In with Face ID on the Login Preferences screen to enable biometric login in the app. The name of this option depends upon the type of biometric login that is available on the device (fingerprint for Touch ID and Android devices, Face ID for Face ID devices). You must enable biometric login on the device before you can enable biometric login in the app. Also, enabling this option also enables Remember Me because Remember Me is required for this option.

When you enable this feature on the Login Preferences screen, the app displays a prompt to explain what this feature does.

Tap OK to close the prompt. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 37 User Settings Tap Menu > User Settings to view the User Settings screen. From the User Settings screen, you can: • Select P2P receive card • Change password • Add card • Delete BOLT$ account Select Receive Card By default, the BOLT$ app selects the first card you add to the service as the “receive” card for P2P payments. Any money that you receive through the P2P service is added to the primary account of the “receive” card. However, you can change the card that receives P2P payments if you have two or more cards in your BOLT$ account.

To change the “receive” card for P2P payments: 1. Tap Menu > User Settings. 2. Tap Select Receive Card on the User Settings screen. The app displays the Your Receive Card screen with details about the current “receive” card: • Last four digits of PAN • Financial institution name and ABA number • Balance information when available • Card Status (whether the card is blocked) • Valid Thru (expiration date) 3. Select the new “receive” card in Change Receive Card and tap Submit.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 38 Change Password The cardholder can update his or her password at any time by following the steps below. Note: You are prompted to change your password if you log in with a password that has not been changed for 365 days. 1. Tap Menu > User Settings. 2. Tap Change Password. 3. Enter the current password and the new password and tap Submit. Note: Passwords must be between 5 and 32 characters long. Passwords must also contain at least one uppercase letter, one lowercase letter, one number and one special character , or *). Your password expires if you do not change it within 365 days.

You are sent an email at your profile’s primary email address every time a change is made to your password. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 39 Add Card You can add cards to your BOLT$ account. 1. Access the card wizard using either of the following methods: • Tap Menu > User Settings, and then tap Add Card button on the User Settings screen. • Tap Add Card on the Cards & Balances screen. 2. Enter your card number and expiration date using either of the following methods: • Tap Capture Card to take a picture of your debit card using the device's camera. (The app must have access to the device's camera.) • Enter the card number and expiration date manually.

3. After you enter the card number and expiration date, enable I accept Terms & Conditions and tap Next to continue. To read the terms and conditions before you accept them, tap the Terms & Conditions link to view the Terms & Conditions screen. Tap Done on the Terms & Conditions screen to continue card enrollment.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 40 4. After the card’s eligibility for BOLT$ is confirmed, you can review a list of what you can do with the card in BOLT$. Click Next to continue. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 41 5. Confirm that the card is yours by entering additional information associated with your card. The information that you enter depends on your financial institution's BIN settings.

• Plastic-based authentication: Enter the last four digits of your Social Security number. • PIN-based authentication: Enter a phone number where you can be reached now. Verify the card number and expiration date and tap Next to continue. If the financial institution uses PIN-based authentication, an automated system calls the phone number you entered. When you receive this call, enter the card's PIN when prompted.

Note: If the information that you enter doesn’t match the information on file with SHAZAM, you are prompted to enter the correct information. If the second attempt is unsuccessful, you will not be able to try again until midnight. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 42 6. To change the “receive” card for P2P payments, select the card under Change Receive Card and tap Submit. Delete BOLT$ Account You can delete your BOLT$ account entirely. You cannot recover your account information after you delete it.

Before you delete your account, ensure that there are no longer any blocks that are set up for any cards on the account. If you delete your account while blocks are active, you must contact your financial institution to remove those blocks. To delete your BOLT$ account entirely: 1. Tap Menu > User Settings. 2. Tap Delete BOLT$ Account on the User Settings screen. 3. Enter your password and tap Submit.

Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 43 ATM Locator Tap Menu > ATM Locator. If the GPS location service is enabled on your device, the screen will pinpoint your current location with a red location bubble. You can pinch the screen to shrink the image and view all ATMs within a three-mile radius or select the list button on the right side of the screen to access a list of ATMs in the immediate area. You can also tap the search function (indicated with a magnifying glass) and enter the location to which you will be traveling.

If there is more than one city with the same name, you will be presented with a drop-down list to select the appropriate location. The locator shows all ATMs within a three-mile radius of the specified location Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 44 About Tap Menu > About to view the About screen. The About screen shows the BOLT$ app version number and details about what the app does. Help Tap Menu > Help to view the Help screen. The Help screen shows the BOLT$ app version number and detailed information about how to use the app. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 45 Feedback Tap Menu > Provide Feedback to enter comments to send to SHAZAM about the app.

Enter any comments that you have and tap Submit to send. Log Out Exit the application by tapping Menu > Log Out and tapping Log Out to confirm. Step Screen

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 46 Troubleshooting SHAZAM BOLT$ has an intuitive design and offers your cardholders self-service options for resolving many common problems. The information below will help you answer cardholder questions. Card Use When a Card is Blocked Temporary Card Blocks (TCBs) placed using BOLT$ transaction control work the same way they do when your financial institution places a TCB. In addition to transactions not working, some of the features of SHAZAM BOLT$ and SHAZAM P2P won’t be available. The lists below describe what actions are available and unavailable to you when your card is blocked: You can...

You can’t...

• Get alert settings • Manage alerts • Add or remove a card SHAZAM BOLT$ Functions • Use the Forgot Password function • Get balances using SHAZAM BOLT$ • Add a new device • Send money Other Functions • Complete monetary transactions (for example: purchases, withdrawals, deposits, etc.) • Get balances at ATMs • Select a PIN using Easy PIN • Activate a card

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 47 Forgot Username You can request your username by following the steps mentioned below. Steps Screen 1. From the login screen, tap Forgot Username.

2. Enter your profile’s primary email address and tap Submit. An email with your username is sent to your profile’s primary email address.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 48 Forgot Password To request a temporary password you can follow the steps mentioned below: Handling Hot-Card Situations If a SHAZAM BOLT$ account has only one card registered and the status of that card is changed to hot, the cardholder must register a new PAN to his or her existing account or create a new account. The following are descriptions of various scenarios, followed by a table of what will occur: • Hot-Card/Knows Password— The only card attached to the user’s SHAZAM BOLT$ account is hot-carded, but he or she knows the password and is logging in with a device that’s previously been registered.

• Hot-Card/Forgot Password — The only card attached to the user’s SHAZAM BOLT$ account is hot-carded, and the user has also forgotten his or her password. • Hot-Card/Device Needs Registering — The only card attached to the user’s SHAZAM BOLT$ account is hot-carded, and the user is trying to access his or her account on a device that hasn’t been registered. Steps Screen 1. From the login screen, tap Forgot Password. 2. Enter your username and tap Submit. An email with a temporary password is sent to your profile’s primary email address.

3. Tap OK to return to the login screen. 4. Copy the temporary password from the email that was sent to your profile’s primary email address.

5. Enter your username and temporary password on the login screen and tap Sign In. 6. The screen will display steps for you to change your password immediately. When you change your password, enter the temporary password again as the current password. Note: Passwords must be between 5 and 32 characters long. Passwords must also contain at least one uppercase letter, one lowercase letter, one number and one special character % , &, or *). Your password expires if you do not change it within 365 days.

You are sent an email at your profile’s primary email address every time a change is made to your password.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 49 Hot-Carding Scenarios and Steps for Cardholders Hot-Card/Knows Password Hot-Card/Forgot Password Hot-Card/Device Needs Registering 1. Log in to SHAZAM BOLT$ on a registered device. 2. Add the new PAN. Note: You must add the new PAN before deleting the old PAN to avoid deleting the entire account. 3. Delete old/hot PAN. 1. Access the SHAZAM BOLT$ app and tap Forgot Password.

2. Retrieve temporary password from email. 3. Enter the username and temporary password into the SHAZAM BOLT$ app.

The account is deleted, and the app displays an alert prompt. An email is sent to you saying, “Your SHAZAM BOLT$ account has been deleted because the remaining card on file was considered a hot-card.” The possible reasons for the hot-carding are then listed. 4. Create a new SHAZAM BOLT$ account and register your new PAN. 1. You attempt to log into SHAZAM BOLT$ using an unregistered device. The account is deleted, and the app displays an alert prompt. An email is sent to you saying, “Your SHAZAM BOLT$ account has been deleted because the remaining card on file was considered a hot-card.” The possible reasons for the hot-carding are then listed.

2. Create a new SHAZAM BOLT$ account and register your new PAN.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 50 On-Screen Error Messages The following table describes how to troubleshoot SHAZAM BOLT$ error messages. On-screen Error Messages If the screen message states . It indicates . Account locked. You are locked out of SHAZAM BOLT$ and must contact your financial institution for assistance. • Card number—Lock occurs after two failed attempts during user registration. You will be able to try again after midnight.

• User—After registration, you may be locked out following four attempts to log in. To unlock your account, tap Forgot Password on the Cards & Balances screen and follow the instructions.

Cannot add card information at this time. Please contact your financial institution or enter another card. Your financial institution has blocked you from enrolling your in any SHAZAM BOLT$ accounts. (Financial institutions can do this by using the Manage SHAZAM BOLT$ button in SHAZAM Access.) Card is not currently eligible. Your financial institution isn’t currently enrolled in the service.

Card is not eligible to send money. Your financial institution has blocked you from initiating P2P Send Money transactions. (Financial institutions can do this by using the Manage SHAZAM BOLT$ button in SHAZAM Access.) Invalid format, please try again. You entered alpha or special characters instead of digits (for example: when entering card number or expiration date). Invalid username. You incorrectly entered your username and should try entering again. Lost connection. Try to perform the function at a later time. Maximum invalid attempts exceeded. Please contact your financial institution.

You have exceeded the maximum attempts to correctly log in to SHAZAM BOLT$.

New password does not meet minimum requirements. You aren’t creating a strong password. Passwords must be between 5 and 32 characters, and include a mix of uppercase and lowercase letters, numbers and special characters. Passwords are case sensitive. New passwords do not match. The passwords entered into the Password and Confirm Password fields don’t match. PAN not valid. Card has either a temporary card block or hot status. Passwords entered do not match. The passwords entered into the Password and Confirm Password fields don’t match.

The activation code you entered has expired. Please re-enable this alert to receive a new activation code.

Repeat the process to enable text message alerting. The activation code you entered is incorrect; please re-enter the mobile number to receive a new activation code. Use the most current 6-digit activation code received.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 51 Cardholder Requests Made Via Text Message Once text message alerting is enabled, the cardholder can make two types of requests via text message. These messages ask the cardholder’s mobile provider or SHAZAM to take action. Cardholder texts STOP “All enabled SHAZAM BOLT$ SMS alerts for this phone number will now be sent to your primary email address.” The cardholder can resume BOLT$ text alerts by texting UNSTOP to 1-888-530-1648, which is the phone number from which BOLT$ text alerts are sent.

Cardholder texts Help “If you need immediate assistance, please contact your financial institution.

Otherwise, please email support@shazambolts.net.” This card is no longer available. Contact your financial institution. At the time of card authentication, the card has either a temporary card block or hot status. Note: May occur when trying to enroll an additional card in SHAZAM BOLT$. Unable to authenticate card at this time. Contact your financial institution. The account has been locked after a second unsuccessful attempt to register a card on SHAZAM BOLT$. Note: The cardholder remains locked out until midnight. Unable to authenticate card at this time. Please try again.

Your financial institution should confirm the card’s status. (The financial institution can confirm the card’s status by using SHAZAM Access Transaction History or the SHAZAM Risk Management (FD020) report.) Unable to perform balance inquiry, please contact your bank. This message displays when there is a temporary card block placed on the card by the cardholder using transaction control or by the financial institution. Unable to verify information. Please try again. The card information couldn’t be validated at the time it was entered (for example: because communication was lost).

Update expiration date.

From the Cards & Balances screen, select Alerts & Settings > Update Expiration Date. Username not available. The selected user name is already in use, and you must select another. On-screen Error Messages If the screen message states . It indicates .

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 52 Notification Options The following table shows the notification distribution methods that are possible for various SHAZAM BOLT$ messages. Notification Options Action Communication Subject Description Primary Email Secondary Email Text Message Transaction alert International - X X X Transaction alert CNP - X X X Transaction alert SHAZAM Fraud Management Services Cases - X X X Transaction alert High - X X X Updated expiration date Card Update User has modified PAN under user’s account. IE expiration date change.

X X User modifies alert settings Alert Settings User has modified alert settings. X X User’s PAN was unblocked by FI FI Card Unblock User’s PAN has been unblocked. X X No P2P recipient; registration required No P2P Recip. - Registration Req A user has attempted to send a P2P transaction to a different cardholder. Cardholder receives notification, plus reminder to register for receiving funds. X X P2P failed P2P Failed P2P transaction failed. Does not include error code. X X P2P received P2P Received P2P transaction processed. User receives this email when funds are received.

X X Confirmation of P2P transaction P2P Send P2P transaction processed.

User receives this email when funds are debited. X X Receipt of P2P P2P Receipt Receipt sent to P2P sender for compliance. X X When the user texts STOP after receiving a text message alert STOP SMS Notifications User has replied STOP to a text message alert. The user will no longer receive alerts via text message for any PAN under the user’s profile. X X X Card added Add Card User adds new card to SHAZAM BOLT$ account. X Card removed Remove Card User removes PAN from SHAZAM BOLT$ account. X

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 53 Email containing activation link to register new device Device Activation User registers new device, due to authenticating from new device. X Notification of new device Device Add User adds new device to list of registered devices. X Successful registration Successful Registration User successfully registers SHAZAM BOLT$ account. X User has accepted the T&C T&C Accepted User has accepted the T&C within SHAZAM BOLT$. X User requests username from SHAZAM BOLT$ or web app Forgot Username User forgot username and requires email reminder of SHAZAM BOLT$ username.

X Email containing activation link to register account Activation User has activated new SHAZAM BOLT$ account. X User requests to have new password emailed Reset PW User has requested new SHAZAM BOLT$ password. X User modifies account such as address Update Profile User has made changes to account profile. X User updates primary email address Update Profile User has modified primary email address. X User updates secondary email address Update Profile User has modified secondary email address. X User updates mobile number Update Profile User has modified mobile number. X Intended recipient has not registered for SHAZAM BOLT$ Registration Reminder User has attempted to send a P2P transaction to a non- SHAZAM BOLT$ cardholder.

A reminder is sent to the cardholder to register for SHAZAM BOLT$ to receive the funds.

X (for the intended recipient) User’s only PAN in SHAZAM BOLT$ was hot-carded; account was deleted Account Deleted User’s only PAN under the SHAZAM BOLT$ account has been hot-carded. The SHAZAM BOLT$ account has since been deleted. X Notification Options Action Communication Subject Description Primary Email Secondary Email Text Message

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 54 Activity Limits If your financial institution subscribes to SHAZAM BOLT$ P2P, cardholders will need to be aware of the following limits.

Card Limit As with all withdrawals and purchases, SHAZAM BOLT$ P2P transactions are subject to the limits you set at the card level. The SHAZAM total daily limit is reduced by the payment amount upon transaction approval. The SHAZAM unmanned and three-day limits don’t apply. The on-screen message within the app will say, “Transaction failed.” You can view the declined transaction in SHAZAM Access transaction history and see the following decline reason Maximum P2P Daily Send Limit During your institution’s SHAZAM BOLT$ enrollment, you were asked to choose a maximum amount you would allow your cardholders to send each day using the SHAZAM BOLT$ app.

One limit is set for each BIN you enrolled, and it doesn’t need to be the same for each BIN. If you choose to charge your cardholders a fee to send a payment, that fee will not affect your cardholders’ maximum P2P daily send limit.

Your institution’s limit(s) are shown on each day’s CD400-R report in the “Max Daily Send” column. Declined Payment Transactions If your cardholder attempts to send a payment which would cause him or her to exceed this limit, the transaction will be declined. The on-screen message within the app will say, “Card daily max limit is exceeded.” You can view the declined transaction in SHAZAM Access transaction history and see the following decline reason: Code Description Description Action Code Completion Code Response Code Message—Transaction amount exceeds remaining daily withdrawal limit. 121 CASMG013 60AG Code Description Description Action Code Completion Code Response Code BIN—Exceeds BIN limit chosen by financial institution 121 BLTBN900 60AG

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 55 The declined transaction will also appear on the SHAZAM Security/Fraud Activity (SCD020) report with the description “Exceeds FTD Lmt.” A request to change a limit may be faxed on letterhead to SHAZAM customer implementation and support (CIS) at 800-267-0549. Anti-Money Laundering (AML) Limit To help you meet AML regulatory requirements, SHAZAM tracks the total payment amounts sent by your cardholders on a daily, weekly and monthly basis. The limits are set by SHAZAM at the system level as: • $2,000 each day (resets at midnight CT) • $6,000 each rolling seven-day period • $10,000 each rolling 30-day period The limits are tracked by the SHAZAM BOLT$ cardholder’s username and include transactions made with all cards associated with one SHAZAM BOLT$ account.

Declined Payment Transactions If your cardholder attempts to send a payment which would cause him or her to exceed one of the limits, the transaction will be declined. The on-screen message within the app will say one of the following: • You have exceeded the daily maximum for send money transactions. • You have exceeded the weekly maximum for send money transactions. • You have exceeded the monthly maximum for send money transactions. You can view the declined transaction in SHAZAM Access Transaction History and see the following decline reasons: Monitoring Activity Use the AML SHAZAM BOLT$ Activity (CD400-R) report to monitor the value of payments your cardholders send within a daily, seven-day and 30-day time frame.

The amounts reported include only approved transaction amounts. Your institution should develop a procedure for investigating activity you feel is suspicious even though it may not exceed the set AML limits.

A transaction declined because of an AML limit will also be listed on the Establisher Exception Journal (SSR105) with the completion code “AG” and description of “Transaction amount exceeds the dollar amount allowed for the transaction.” You may also use this information to monitor for possible suspicious activity. Code Descriptions Limit Exceeded Action Code Completion Code Response Code $2,000 daily 110 BLTNR900 13AG $6,000 seven-day 110 BLTNR901 13AG $10,000 30-day 110 BLTNR902 13AG

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 56 PIN-Authentication Threshold Amount If your institution requires your cardholders to perform PIN-based authentication when enrolling in SHAZAM BOLT$, this limit also applies. This limit allows you to choose the transaction value under which a cardholder may send a payment without needing to enter his or her PIN to complete the transaction. One threshold is set for each BIN you enrolled, and it doesn’t need to be the same for each BIN. The threshold amount may not exceed the maximum daily send limit set for the BIN. A request to change the threshold amount may be faxed on letterhead to SHAZAM CIS at 800-267-0549.

The Cardholder Experience When a cardholder initiates a payment for an amount that would exceed the BIN threshold, he or she will be asked to enter a phone number. SHAZAM’s IVR system will immediately call and ask the cardholder to enter his or her PIN on the phone’s keypad.

If the PIN is entered correctly, the transaction proceeds. If it’s entered incorrectly, the transaction is declined with an incorrect PIN response. The on-screen message within the app will say, “Transaction failed.” You can view the declined transaction in SHAZAM Access transaction history and see the following decline reason: Code Description Description Action Code Completion Code Response Code PIN—Invalid PIN 117 CASPN002 55PV

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 57 Sample Email and Text Message Verbiage Cardholders will receive an email each time something is added, removed or updated within the SHAZAM BOLT$ app.

Cardholders may also receive emails or text messages for many different alerts and transactions. BOLT$ email alerts are received from notification@shazambolts.net, and BOLT$ text message alerts are received from 1-888-530-1648. The following section contains examples of the most common email and text message alerts. Transaction Alerts SHAZAM BOLT$ users will receive the following alerts if a qualifying event occurs. Note: Refer to “Card Actions” on page 19 for more information about setting transaction alerts. Temporary Card Block Alert Cardholders may receive the following email when a transaction is declined because of a temporary card block on their card.

No SMS alerts are sent for transactions that are declined because of a temporary card block.

Email alert Subject: Transaction Declined Alert Based on your card block settings, your card ending in 9999 is blocked for all transaction activity and the following transaction has been declined: 11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Declined If you did not authorize this transaction attempt, please contact your financial institution. Failure to contact your financial institution may affect your liability for unauthorized transactions. To unblock your card, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website.

Beware of any email you receive requesting your PIN, password, or similar access for debit cards, credit cards or other financial accounts.

Legitimate businesses will never request detailed information from you through email.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 58 Transaction Over Amount Alert Cardholders may receive transaction amount alerts based on settings they select in SHAZAM BOLT$. Block Enabled Cardholders may receive the following messages if they have set up a “transaction over amount” block. Text message alert • “Card ending 9999 blocked a $XXX charge @ XXXXXXXXXX for exceeding $XXX limit. Contact your financial institution if unauthorized. Text STOP to opt out of SMS” Email alert Alert Only Cardholders may receive the following messages if they have set up a “transaction over amount” alert but not a block.

Text message alert • “Card ending 9999 used @ XXXXXXXXXX for $XXX. Amount exceeds $XXX limit. Contact your financial institution if unauthorized. Text STOP to opt out of SMS” Subject: Transaction Declined: Exceeds Amount Allowed Based on your alert settings for card ending in 9999, the following transaction was blocked because the amount exceeded your threshold limit: 11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Declined If you did not attempt to make this transaction, please contact your financial institution. To change your alert or block criteria, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website.

Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 59 Email alert International Transaction Alert Cardholders may receive international transaction alerts based on settings they select in SHAZAM BOLT$.

Block Enabled Cardholders may receive the following messages if they have set up an international transaction block. Text message alert • “Card ending 9999 blocked an international charge for $XXX @ XXXXXXXXXX. Contact your financial institution if unauthorized. Text STOP to opt out of SMS” Subject: Transaction Amount Alert Based on your alert settings for card ending in 9999, you are receiving this alert because the following transaction exceeded your threshold limit: 11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Approved If you did not authorize this transaction, please contact your financial institution.

To change your alerting criteria, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website.

Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 60 Email alert Alert Only Cardholders may receive the following messages if they have set up an international transaction alert but not a block.

Text message alert • “Card ending 9999 was used internationally for $XXX @ XXXXXXXXXX. Contact your financial institution if unauthorized. Text STOP to opt out of SMS” Email alert Subject: International Transaction Declined Based on your alert settings for card ending in 9999, the following transaction was blocked because it occurred outside of the United States.

11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Declined If you did not attempt to make this transaction, please contact your financial institution. To change your alerting or blocking criteria, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

Subject: International Transaction Alert Based on your alert settings for card ending in 9999, you are receiving this alert because the following transaction occurred outside of the United States. 11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Approved If you did not attempt to make this transaction, please contact your financial institution. To change your alerting criteria, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website.

Failure to contact your financial institution may affect your liability for unauthorized transactions.

Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 61 Internet or Phone Transaction Alert Cardholder may receive internet / phone transaction alerts based on settings they select in SHAZAM BOLT$. Block Enabled Cardholders may receive the following messages if they have set up an internet / phone transaction block. Text message alert • “Card ending 9999 blocked when used via phone/internet for $XXX @ XXXXXXXXXX. Contact your financial institution if unauthorized. Text STOP to opt out of SMS” Email alert Alert Only Cardholders may receive the following messages if they have set up an internet / phone transaction alert but not a block.

Text message alert • “Card ending 9999 was used via phone/internet for $XXX @ XXXXXXXXXX. Contact your financial institution if unauthorized. Text STOP to opt out of SMS” Subject: Card-Not-Present Transaction Declined Based on your alert settings for card ending in 9999, the following transaction was blocked because it occurred on the phone or internet: 11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Declined If you did not authorize this transaction, please contact your financial institution. To change your alerting or blocking criteria, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website.

Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 62 Email alert Suspicious Transaction Alerts Your cardholder can receive suspicious transaction alerts if your financial institution subscribes to SHAZAM Fraud Management Services.

There are two types of suspected transaction alerts: standard suspicious activity alerts and high-risk suspicious transaction alerts. Your cardholders can opt out of receiving text alerts from SHAZAM by replying STOP when they receive a text alert. If the cardholder wishes to opt into receiving text alerts from SHAZAM later, the cardholder must ask their financial institution to call SHAZAM Fraud Operations to make the change. Standard Suspicious Activity Alert If the cardholder receives a standard transaction alert through SHAZAM BOLT$, he or she is instructed to call SHAZAM toll-free at (855) 219-5399 to review the suspicious activity.

Text message alert • “A Fraud alert was opened for card ending 9999, due to suspected fraud. Please call 855-219-5399 as soon as possible. Text STOP to opt out of SMS.” Subject: Card-Not-Present Transaction Alert Based on your alert settings for card ending in 9999, you are receiving this alert because the following transaction occurred on the phone or internet.

11/12/19 11:18:46 1.79 QUIKTRIP ANYPLACE IA50000 Approved If you did not attempt to make this transaction, please contact your financial institution. To change your alerting criteria, use your financial institution's card control tool - either SHAZAM BOLT$ or your financial institution's app or website. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 63 Email alert High-Risk Suspicious Transaction Alert If the cardholder receives a high-risk transaction alert through SHAZAM BOLT$, he or she is instructed to call SHAZAM toll-free at (855) 219-5399 to review the suspicious activity. SHAZAM places a temporary card block on the card to prevent additional activity from occurring until the cardholder has confirmed the activity is not fraud. Text message alert • “A Fraud alert was opened for card ending 9999. Your card is temporarily blocked. Call 855-219- 5399 immediately.

Text STOP to opt out of SMS.” Subject: Suspicious Activity Alert.

You are receiving this suspicious transaction alert because your financial institution subscribes to SHAZAM Fraud Management Services and we have identified high-risk activity on your account. Please contact SHAZAM at (855) 219-5399 to review this suspicious activity. You may also contact your financial institution directly during their regular business hours. Potentially suspicious activity on card ending in 9999: 11/12/19 11:15:58 100 QUIKTRIP ANYPLACE IAApproved 10/17/19 15:53:09 1.26 CASEYS JACKSON IAApproved 10/12/19 13:35:51 1.74 QT XXX ANYPLACE IAApproved Failure to contact your financial institution may affect your liability for unauthorized transactions.

Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 64 Email alert SHAZAM BOLT$ Notifications Primary email address change Subject: Suspicious Transaction Alert You are receiving this suspicious transaction alert because your financial institution subscribes to SHAZAM Fraud Management Services, and we have identified high-risk transactions on your account. A temporary block has been placed on your card to prevent additional activity from occurring. Please contact SHAZAM at (855) 219-5399 to review this suspicious activity. You may also contact your financial institution directly during their regular business hours.

Potentially suspicious activity on card ending in 9999: 11/12/19 11:15:58 100 QUIKTRIP ANYPLACE IAApproved 10/17/19 15:53:09 1.26 CASEYS JACKSON IAApproved 10/12/19 13:35:51 1.74 QT XXX ANYPLACE IAApproved Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

Subject: SHAZAM BOLT$ Activation You are receiving this email to notify you that your SHAZAM BOLT$ account has been updated. Please review the changes below to ensure they were made by an accountholder. If you did not make these changes we encourage you to log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party. During regular business hours you may also contact your financial institution directly for assistance. 02/23/2019 10:12:56:: User Profile:: Primary Email Address Change.

Failure to contact your financial institution may affect your liability for unauthorized transactions.

Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 65 Secondary email address change Alert Settings Change “You are receiving this email to notify you that your SHAZAM BOLT$ account has been updated. Please review the changes below to ensure they were made by an accountholder. If you did not make these changes we encourage you to log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party. During regular business hours you may also contact your financial institution directly for assistance. 02/23/2019 13:37:24:: Alert Management:: Alert settings for Card number ending with 0019 has been updated.

Current Alert Settings: Alert Type Primary Email Secondary Email Mobile Transaction over $100.00 Enabled Enabled Enabled International transactions (outside of US) Enabled Enabled Enabled Internet or phone transactions Enabled Enabled Enabled Suspected Fraud Alerts Enabled Enabled Enabled Subject: SHAZAM BOLT$ Alert You are receiving this email to notify you that your SHAZAM BOLT$ account has been updated. Please review the changes below to ensure they were made by an accountholder. If you did not make these changes we encourage you to log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party.

During regular business hours you may also contact your financial institution directly for assistance. 02/22/2019 17:24:33:: User Profile:: Secondary Email Address Change. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 66 Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.” Device added (during BOLT$ registration) SHAZAM BOLT$ Notifications Enabled Enabled Disabled Alert Type Primary Email Secondary Email Mobile Subject: SHAZAM Beta Bank Alert You are receiving this email to notify you that your SHAZAM BOLT$ account has been updated.

Please review the changes below to ensure they were made by an accountholder. If you did not make these changes we encourage you to log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party.

During regular business hours you may also contact your financial institution directly for assistance. 02/23/2019 10:23:04:: Device Management:: New device has been added. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc.

Page 67 Card added (during BOLT$ registration) User added (during BOLT$ registration) Subject: SHAZAM Beta Bank Alert You are receiving this email to notify you that your SHAZAM BOLT$ account has been updated. Please review the changes below to ensure they were made by an accountholder. If you did not make these changes we encourage you to log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party.

During regular business hours you may also contact your financial institution directly for assistance. 02/23/2019 10:23:04:: Card Management:: Card number ending with 0011 has been added. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

Subject: SHAZAM Beta Bank Alert You are receiving this email to notify you that your SHAZAM BOLT$ account has been updated.

Please review the changes below to ensure they were made by an accountholder. If you did not make these changes we encourage you to log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party. During regular business hours you may also contact your financial institution directly for assistance. 02/23/2019 10:23:04:: User Profile:: New user with user name USERADD has been registered. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email.

Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 68 Activation Email The following is an example of an email your cardholder or a person he or she invites to register will receive when completing the registration process. Forgot Password Email The following is an example of an email your cardholders receive when they forget their password. Subject: SHAZAM BOLT$ Activation Thank you for using SHAZAM BOLT$. To activate your SHAZAM BOLT$ account, please tap the link below: https://sampleConfirmationLink.net/abcd123 Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

Legitimate businesses will never request detailed information from you through email.

Subject: SHAZAM BOLT$ Alert: Temporary Password You are receiving this email to notify you of your SHAZAM BOLT$ account temporary password. When logging on with this temporary password, you will be required to validate your identity through device registration. After validation, you should access User Settings to Change Password. If you forget to create a new password, you will be prompted to change your password on the next use of the temporary password. Please review the changes below to ensure they were made by an accountholder. If you did not make these changes, we encourage you to contact your financial institution for assistance.

During regular business hours you may also contact your financial institution directly for assistance. 06/11/14 10:54:39:: Password Management:: Your temporary password is zxHD16*( Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 69 Maintenance Alert Email The following is an example of an email your cardholders receive when they update their email address on file. Cardholders will receive similar emails when any change is made to their profile information (such as adding or deleting a card, phone number, etc.). New Device Registration Email The following is an example of an email your cardholder receives when he or she adds a new device to an existing SHAZAM BOLT$ account.

Subject: SHAZAM BOLT$ Account Update Confirmation You recently updated the email address linked to your SHAZAM BOLT$ account.

Select the confirmation link below to approve this update. https://sampleConfirmationLink.net/abcd123 If you have received this email in error, please disregard and remove from your inbox. Subject: SHAZAM BOLT$ Device Registration To register your device in SHAZAM BOLT$, please tap the link below: https://sampleConfirmationLink.net/abcd123 Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts. Legitimate businesses will never request detailed information from you through email.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 70 Card Expiration Email The following is an example of an email your cardholder receives one week before one of the cards on the SHAZAM BOLT$ account is set to expire. (This email is sent only if the card is not a SHAZAMChek card. The expiration dates of SHAZAMChek cards are updated automatically during card activation.) Subject: Alert SHAZAM BOLT$ Alert: Card about to expire A debit card you've registered in SHAZAM BOLT$ is about to expire. After the card expires, you'll no longer be able to receive money from other SHAZAM BOLT$ users.

To continue receiving fund transfers, log in to SHAZAM BOLT$ and update the expiration date to match the replacement card you've received from your financial institution.

Download the SHAZAM BOLT$ app from: Google Play™ Apple® App Store Or, use SHAZAM BOLT$ on the web at: https://bolts.shazam.net Thanks for using SHAZAM BOLT$!

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 71 Hot-Card Account Deletion Alert A cardholder’s account will be automatically deleted if the only card on file has been hot-carded. The following is an example of an email your cardholder receives as notification of the deletion of an account. Subject: SHAZAM BOLT$ Alert: User Account Deleted Your SHAZAM BOLT$ account has been deleted because the remaining card on file was considered a “hot” card and the account was locked out.

The card may have been marked as “hot” by your financial institution for one of the following reasons: • Fraud occurred on the card. • The card number was compromised. • The card was lost or stolen. • The account has been closed. Additionally, your account may be locked out for one of the following reasons: • Your device needs to be authenticated or re-authenticated. • You requested a temporary password. • You had multiple failed login attempts. 07/04/2019 11:22:46 :: User Account Deleted:: You may reregister your account with a new card using your previous username, JJones12, and primary email address.

The more secure you keep your card, the better we can protect your account. As a result, setting up transaction alerting upon re-establishing your new card may be in your best interest. REREGISTER: https://bolts.shazam.net/NewAccount If you have any questions, you may contact your financial institution during regular business hours. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for credit cards, banks, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 72 SHAZAM BOLT$ Person to Person (P2P) Emails Cardholders will receive emails similar to those included in this section depending on whether they are a sender or receiver of funds through SHAZAM BOLT$ P2P. Registration Emails SHAZAM BOLT$ users will receive the following emails when a P2P user wants to send money to an unregistered recipient, or a recipient who has registered for SHAZAM BOLT$ but doesn’t have an active card on file.

Invitation to Unregistered Recipient The following is an example of an email to a potential recipient.

It provides a link for him or her to click to complete registration. Subject: SHAZAM BOLT$ Registration Invite would like to send you money. To receive the funds, simply enroll in SHAZAM BOLT$ by and register your debit card by selecting New Mobile Card User. Download the SHAZAM BOLT$ app from: Google Play™ Apple® App Store Or, use SHAZAM BOLT$ on the web at: https://bolts.shazam.net Click here for more information about SHAZAM BOLT$. If there is a question about the legitimacy of this email, contact the sender requesting your registration before continuing. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 73 Invitation to Registered Recipient The following is an example of an email to a potential recipient. It provides a link for him or her to click to complete registration. Subject: SHAZAM BOLT$ Registration Invite would like to send you money. To receive the funds, simply register your debit card by to your existing SHAZAM BOLT$ account. Don't have the SHAZAM BOLT$ app? Download the app from: Google Play™ Apple® App Store Or, use SHAZAM BOLT$ on the web at: https://bolts.shazam.net Click here for more information about SHAZAM BOLT$.

If there is a question about the legitimacy of this email, contact the sender requesting your registration before continuing. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 74 Registration Reminder to Recipient The following is an example of an email to a potential recipient who hasn’t registered for SHAZAM BOLT$. This email is sent the day before the registration window closes (the fourth day after the invitation is sent). It provides a link for the recipient to click to complete registration. Recipient Registration Failed The following is an example of an email to the sender when the recipient fails to register for SHAZAM BOLT$ within the registration window.

Recipient Ready to Receive Funds The following is an example of an email to the sender when a recipient successfully registers for SHAZAM BOLT$ and is ready to receive money.

Subject: SHAZAM BOLT$ Registration Reminder Time is running out to receive money from . To receive the funds, simply access SHAZAM BOLT$ by and register a valid debit card. Don't have the SHAZAM BOLT$ app? Download the app from: Google Play™ Apple® App Store Or, use SHAZAM BOLT$ on the web at: https://bolts.shazam.net Click here for more information about SHAZAM BOLT$. If there is a question about the legitimacy of this email, contact the sender requesting your registration before continuing. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

Subject: SHAZAM BOLT$ Registration Invite Status , On , you sent a SHAZAM BOLT$ registration request to . The intended recipient declined or is unable to register. You may attempt to resend the request; however, SHAZAM BOLT$ suggests you contact the recipient prior to doing so.

Subject: SHAZAM BOLT$ Registration Invite Successful On , you sent a SHAZAM BOLT$ registration request to . The intended recipient is now registered. You may proceed with sending funds.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 75 Registered Recipient Unable to Receive Funds The following is an example of an email to the sender when a recipient successfully registers for SHAZAM BOLT$ but is unable to receive money. Subject: SHAZAM BOLT$ Registration Invite , On , you sent a SHAZAM BOLT$ registration request to .

The intended recipient has registered but is unable to receive funds at this time. If you have any questions, please contact the intended recipient.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 76 SHAZAM BOLT$ P2P Sender Receipt The following is an example of an email your cardholder receives as a receipt for any funds he or she transferred to another cardholder: Subject: Financial Institution Alert You are receiving this email with information regarding your recent transfer using the SHAZAM BOLT$ application. Your funds have successfully been transferred to JaneyJones@gmail.com. Below is a receipt of the transaction for your records.

06/17/2019 15:24:45: Transaction Management If you did not perform this transaction, please log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party.

You may also contact your financial institution for assistance during regular business hours. Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

Amount transferred $ Service fee $ Total amount $ Transaction type SHAZAM XFER Sender ZIP code 50321 Send card ending in x0110 Send from account type Checking Reference number 1403036679652000 Transfer date & time 06/17/2019 15:24:45 Recipient nickname Mrs. Receive Recipient email JaneyJones@gmail.com Memo Lunch

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 77 SHAZAM BOLT$ P2P Recipient Receipt The following is an example of an email your cardholder receives as a receipt for any funds he or she received from another cardholder: Subject: Financial Institution Alert You are receiving this email with information regarding a successful transfer to your account via the SHAZAM BOLT$ application.

The receipt displayed below is a summary of the transaction that was initiated by jjones@gmail.com. Please review to ensure that the correct amount has been transferred. 06/23/2019 14:31:47: Transaction Management If you are not the intended recipient of this transfer, please contact your financial institution immediately for assistance.

Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts. Amount transferred $10.00 Transaction type SHAZAM XFER Receive card ending in x0037 Transfer to account type Checking Reference number 1403551904644000 Transfer date & time 06/23/2019 14:31:47 Sender name User Name Sender email jjones@gmail.com Sender ZIP code 50313 Memo Dinner for two

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 78 SHAZAM BOLT$ P2P Failed Transaction Alert The following is an example of an email your cardholder receives when the SHAZAM BOLT$ P2P transaction he or she initiated fails. The reason a transaction failed could be any one of the following: • The transaction would cause the cardholder to exceed his or her daily limit. • There are insufficient funds (NSF) to approve the payment. • The card has a temporary card block on it. • The card is in a hot-card status. • The card isn’t activated. • The card is expired.

• The account has a stale balance. Subject: Financial Institution Alert We apologize; we are unable to process your transaction at this time. No charges should be incurred from this attempt. Please feel free to try your transaction again at a later time. 06/16/2019 13:38:35: Failed Transaction Attempt Attempted Transaction Details: If you did not attempt to send this transaction, please log into your SHAZAM BOLT$ account and change your password to prevent additional access by an unauthorized party. You may also contact your financial institution for assistance during regular business hours.

Failure to contact your financial institution may affect your liability for unauthorized transactions. Keep in mind that legitimate businesses will never request detailed information from you through email. Beware of any email you receive requesting your PIN, password, or similar access information for debit cards, credit cards, or other financial accounts.

Amount transferred $ 15.00 Service fee $ 0.15 Total amount $ 15.15 Sender ZIP code 50321 Send card Ending in x0227 Send from account type Checking Reference number 1402943914262000 Transfer date & time 06/16/2019 13:38:35 Recipient nickname Grandma Recipient email janeyjones@gmail.com Memo -

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 79 Manage BOLT$ in SHAZAM Access The Manage BOLT$ button is located on the right side of the Cards screen in SHAZAM Access. This button leads to the Manage SHAZAM BOLT$ page, which is used by both SHAZAM BOLT$ and SHAZAM BOLT$ API financial institutions.

Functionality On the Manage SHAZAM BOLT$ page, you can: • View the cardholder’s SHAZAM BOLT$ enrollment status (Enrolled or Not Enrolled). • Restrict the cardholder’s access to certain SHAZAM BOLT$ features. By default, your cardholders have access to all features that your financial institution subscribes to.

• View the cardholder’s settings for contact information, alerts and blocks.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 80 Feature Restrictions Your options for restricting a cardholder’s access to features are described below. Access Restrictions Option Description Message When Cardholder Attempts to Use Feature Remove this PAN from SHAZAM BOLT$ This option removes the PAN from its association with any existing SHAZAM BOLT$ accounts. However, it doesn't prohibit a cardholder from re- adding the PAN. To permanently remove a PAN, use the “Block PAN from future enrollments” option.

A SHAZAM BOLT$ account may have more than one card registered, and possibly with multiple financial institutions. Once the account has no registered cards, it’s considered a “profile only” account. None. Block PAN from future enrollments Use this option to block the cardholder from enrolling his or her PAN in any SHAZAM BOLT$ account. Cannot add card information at this time. Please contact your financial institution or enter another card. Exclude PAN from the Send Money feature Use this option to block a cardholder from initiating P2P Send Money transactions. The Send Money feature isn’t available to SHAZAM BOLT$ API financial institutions and their cardholders.

Card is not eligible to send money. Exclude PAN from SHAZAM BOLT$ SMS alerting Use this option to block a cardholder’s ability to enable text message alerts. You will remove text message alerting as an option for your cardholder. Return to this screen and uncheck the box to allow the text message alerting option for your cardholder again. Note: Cardholder will not see the option to enable text messages for any alerts if not subscribed.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 81 Cardholder Settings At the bottom of the Manage SHAZAM BOLT$ page, you can view the cardholder settings described and pictured below.

1. Cardholder’s username. One card may be enrolled in multiple accounts. 2. User profile contact information entered by the cardholder. • A primary email address is required and can’t be edited in the Alert Delivery Settings screens. • A secondary email address is optional and can be edited in the Alert Delivery Settings screens, causing alerts to distribute to a different secondary email address than is found in the user’s profile.

• The mobile number is optional and can be edited in the Alert Delivery Settings screens, causing the mobile number in the user profile to update as well. 3. Card block status. If the cardholder has placed a temporary card block, the status “Card blocked by cardholder” will display here. If not, this space will be blank. 4. Alert and block table. This table shows the transaction blocks and alerts available to users. • The Block Enabled column shows whether the cardholder has selected a transaction type to be blocked.

• The Primary Email, Secondary Email and Mobile Number columns show the cardholder’s selected notification method for transaction blocks and alerts.

Note: A user can’t disable Suspected Fraud Alerts or SHAZAM BOLT$ Notifications to his or her primary email address. For SHAZAM BOLT$ Notifications, delivery to a mobile number isn’t an option.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 82 Researching Transactions Use the SHAZAM Access Transactions tab to research balance inquiries, BOLT$ P2P transactions or BOLT$ transaction control history. Identify BOLT$ Balance Inquiries in SHAZAM Access Transaction Detail When a cardholder checks an account balance using BOLT$, the inquiry is processed in the same way as an ATM balance inquiry. To help you identify balance inquiries completed using BOLT$, look at the following fields in SHAZAM Access Transaction Detail: Note: You may decide to use some of the fields above to program your core system if you service charge and don’t want to charge for SHAZAM BOLT$ balance inquiries.

Identify BOLT$ P2P Transactions in SHAZAM Access Transaction Detail To help you identify BOLT$ P2P transactions, look at the following fields in SHAZAM Access Transaction Detail: SHAZAM Access Transaction Detail Fields and Values for Balance Inquiries Field Value / Description Terminal ID Unique number assigned to each institution Merchant Name Begins with BOLT$ DE 42 Begins with BOLT$ SHAZAM Access Transaction Detail Fields and Values for SHAZAM BOLT$ P2P Transactions Field Value/Description Trans Desc FUNDS TFR DR (CR) from DDA will appear. Terminal This is the terminal number assigned to the payment sender’s financial institution’s SHAZAM BOLT$ program.

You can use this number to search for multiple transactions.

Card Acceptor ID BOLT$ MOBILE will appear. Merchant Name This field will display the payment sender’s name (last and first). Internet This field will display N for approved transactions and Y for denied transactions. Sender Reference # This field will populate for all approved transactions. Use this number to see both sides of a transaction (the debit and credit) on the Transaction Search screen.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 83 Identify BOLT$ Transaction Control Maintenance in SHAZAM Access Transaction Detail To help you identify BOLT$ transaction control maintenance, look at the following fields in SHAZAM Access Transaction Detail: SHAZAM Access Transaction Detail fields and values for BOLT$ transaction control maintenance Field Value/Description User ID Displays the cardholder’s BOLT$ user name if the Maint Type is MOBILE; otherwise, displays the user ID of the SHAZAM Access user who completed the action.

Message Type 1304 — Maintenance Function Code Possible values include: • 390 — Temporary Card Unblock • 391 — Temporary Card Block Maint Type Possible values include: • MOBILE — Completed by cardholder • ACCESS — Completed by financial institution • CS ACCES — Completed by SHAZAM client support

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 84 SHAZAM BOLT$ Denials in SHAZAM Access To help you identify SHAZAM BOLT$ transaction denials, look at the following fields in SHAZAM Access Transaction Detail: Action and Completion Code Descriptions for SHAZAM BOLT$ Transactions Action Code Description Response Code Code Number Code Description 104 Restricted card CD014 CAS or SWX Card (PAN) — Card is temporarily blocked. 108 Refer to card issuer’s special conditions 50PC PC018 CAS or SWX PAN block — Card-not-present transaction is blocked by cardholder.

50PC PC019 CAS or SWX PAN block — International transaction is blocked by cardholder. 50PC PC020 CAS or SWX PAN block — Dollar amount is above threshold set by cardholder and transaction is blocked by cardholder. 50PC PF018 CAS or SWX PAN block — Card-not-present transaction is blocked by financial institution. 50PC PF019 CAS or SWX PAN block — International transaction is blocked by financial institution. 50PC PF020 CAS or SWX PAN block — Dollar amount is above threshold set by cardholder and transaction is blocked by financial institution. 110 Invalid dollar amount 13AG NR900 BLT Network Rule — Exceeds daily AML limit.

13AG NR901 BLT Network Rule — Exceeds weekly AML limit. 13AG NR902 BLT Network Rule — Exceeds monthly AML limit. 117 Incorrect PIN 55PV PN002 CAS PIN — Invalid PIN. 121 Exceeds withdrawal limit amount 60AG BN900 BLT BN — Exceeds BIN limit chose by financial institution. 60AG MG013 CAS Message — Transaction amount exceeds remaining daily withdrawal limit.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 85 Using SHAZAM Reports The following SHAZAM reports can help you manage and track your cardholders who use SHAZAM BOLT$ and the SHAZAM BOLT$ P2P service.

AML SHAZAM BOLT$ Activity (CD400-R) Report Institutions that subscribe to SHAZAM BOLT$ P2P receive this report daily in the SETL folder, regardless of activity. This report represents anti-money laundering (AML) activity associated with a financial institution’s SHAZAM BOLT$ P2P service. It contains the following information: sender PAN, sender user ID, max daily send, daily volume, seven-day volume and 30-day volume. Card Account File Maintenance (CD200-R) Report This report provides detailed information about card account file maintenance performed. To identify TCBs placed or removed by a cardholder, look for the following values in this report: • Cardholder’s SHAZAM BOLT$ user ID in the User ID column • “MOBILE” in the Origination Point column • 390/Temporary Card Unblock or 391/Temporary Card Block in the Function Code column Cardholder Institution Activity (SSR110) Report You receive this report daily in your SETL folder.

This report will indicate a funds transfer credit for any SHAZAM BOLT$ cardholder receiving money and a funds transfer debit for any SHAZAM BOLT$ cardholder sending money. This report will also include balance inquiry transactions your cardholders perform through SHAZAM BOLT$.

Establisher Exception Journal (SSR105) Report You receive this report daily in your SETL folder. This report will indicate if a P2P transaction is declined due to an AML limit. This report will contain a completion code “AG” and description of “Transaction amount exceeds the dollar amount allowed for the transaction.” Establishing Institution Activity (SSR120) Report You receive this report daily in your SETL folder. This report will indicate a funds transfer credit to offset the debit your sending cardholder receives on the SSR110. The report will also indicate a funds transfer credit, which includes any convenience fee you establish.

This report will also include balance inquiry transactions your cardholders perform through SHAZAM BOLT$.

Institution Settlement Summary (SSR130) Report You receive this report daily in your SETL folder. This report will contain a settlement subtotal for your SHAZAM BOLT$ activity.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 86 Mobile Activity (CM401-D) Report This report is available on the first day of each month in the SETL folder as a comma-separated values (CSV) file. It contains the following information based on your product selections (for example: P2P funds transfers, text message alerting or transaction control): • Username • PAN • Total balance inquiries • Total transaction alerts (includes both email and text message alerts) • Total case alerts (includes both email and text message alerts) • Terms and conditions accept date • Email • BOLT$ funds transfer enrollment status • FTD send amount • FTD send count • FTD send income • FTC receive amount • FTC receive count • Transaction control • Activity count • Total text message alerts • Total declines due to cardholder blocks SHAZAM Risk Management (FD020-R) Report You receive this report daily in your Fraud folder, unless there isn’t activity to report.

This report provides a summary of the prior day’s attempts to sign up for SHAZAM BOLT$ where the PAN and SSN have been checked. This report also shows authentication results for financial institutions that use PIN-based authentication. Monitor this report regularly to track SHAZAM BOLT$ enrollment. If you see denied attempts, you may consider contacting your cardholder to make sure he or she attempted to enroll. This report is also used to track the prior day’s attempts to sign up for Mastercard SecureCode, Verified by Visa and SHAZAM myPic Studio where the last four digits of the SSN have been checked.

You will only see activity for the services you have selected.

SHAZAM Security / Fraud Activity (SCD020) Report You receive this report daily in your SETL folder if your institution has transactions that exceed your established security thresholds. This report will contain an “Exceeds FTD Limit” line item if your cardholder exceeds the maximum daily send limit established by your institution. Temporary Card Block (FW310-R) Report You receive this report every Thursday in your SETL folder. This report will contain all cards that have a TCB placed in the previous week. This report allows you to review cards that currently have a temporary blocked status to decide whether to remove the temporary blocked status or to permanently hot card the card.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 87 Settlement and Balancing for P2P Transactions Even though they aren’t conducted at an ATM or POS terminal like a traditional card transactions, P2P transactions settle similarly on your SHAZAM reports. Cardholder Reports and Settlement SHAZAM BOLT$ P2P transactions involving your cardholder as either the payment sender or recipient appear on your SSR110 report as described below. Additionally, the settlement for the transactions is included in the report’s “Institution Net” amount. The cardholder’s DDA or savings account is debited or credited in the same way as any other card transaction (ATM withdrawal, POS purchase, etc.).

When your cardholder is the sender of a payment and you charge a service fee, the fee amount is added to the payment amount and one total is debited. Terminal Reports and Settlement When you subscribe to the SHAZAM BOLT$ product, SHAZAM assigns a terminal number to be used to log SHAZAM BOLT$ transactions. These transactions include both balance inquiries and, if applicable, P2P payments to other cardholders. You will receive a separate SSR120 report showing this activity. One P2P payment generates two transactions on your report, both a debit and a credit, resulting in a net settlement amount of zero.

The fee amount you charge your cardholders for each payment is also shown on the report, much like an ATM surcharge, and is settled as a credit.

The SSR120 “Terminal Net” will equal the total of the day’s income generated when your cardholders make payments to other cardholders. To book the fees collected, you will need to manually post the amount as a credit to your SHAZAM BOLT$ income general ledger and a debit to your SHAZAM Daily Settlement account. SHAZAM BOLT$ P2P Transactions Cardholder Action Settlement Effect Transaction Codes Sender (with service charge) Makes a payment Debit 112 (DDA withdrawal) 411 (P2P payment) 814 (Service charge) Sender (without service charge) Makes a payment Debit 112/411 (DDA withdrawal/ P2P payment) Receiver Receives a payment Credit 111/432 (DDA deposit/P2P payment)

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 88 Change Log Below is a summary of changes that have been made to this document. Revision History Date Action Section and Description of Change September 13, 2018 Update The user interface of the mobile app is completely updated and modernized for improved usability. Updated Suspicious Transaction Alert text (SMS) and email messages that are sent by BOLT$ if SHAZAM Fraud Management Services detects potentially fraudulent activity (new phone number to call).

June 8, 2018 Update Updated text (SMS) messages that are sent by SHAZAM BOLT$ in the following circumstances.

These text messages now include transaction dollar amounts. • Transaction over amount • International • Internet/phone February 22, 2018 Update Updated Sample Email and Text Message Verbiage > Transaction Alerts with new verbiage that is shared by users of the SHAZAM BOLT$ app, portal, and API. January 4, 2018 Update Updated information about the new Fingerprint Log In, Quick Balance, Remember Username and Expiration Date Update features and about access to the ATM locator from the mobile app Cards & Balances screen. Also added information about how financial institutions can integrate SHAZAM BOLT$ alerts and blocking into their web portals and mobile apps by using the SHAZAM BOLT$ application programming interface (API).

• Introduction — Reorganized section and added subsection on integrating SHAZAM BOLT$ into your mobile app or web portal.

• Authentication and Security — Added information about Fingerprint Log In. • Cardholder Enrollment — Updated screenshot to include new Remember Me checkbox. • Login — Added and updated screenshots to illustrate new Fingerprint Log In, Quick Balance and Remember Username features. • Features — Added and updated screenshots to illustrate how to set up the Fingerprint Log In, Quick Balance and Remember Username features in Login Settings. • Card Expiration Email — This new alert email is sent to cardholders when the card is about to expire and SHAZAM is unable to update the expiration date automatically.

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 89 July 13, 2017 Update Introduction — Updated the bullet about setting blocks. Features > Card Actions — Added Set Alerts and Blocks section. Removed Transaction Control section. Troubleshooting — Formatted Notification Options table. Moved the table from the Sample Email and Text Message Verbiage section to this section. Sample Email and Text Message Verbiage — Added sample verbiage regarding transaction blocks. Added subheadings for Block Enabled and Alert Only.

Manage BOLT$ in SHAZAM Access — Added subheadings and updated screenshots.

Added details on the new card block status field and the updated alert and block table. Researching Transactions > SHAZAM BOLT$ Denials in SHAZAM Access — Added action code 108. Using SHAZAM Reports > Mobile Activity (CM401-D) Report — Added field for total declines due to cardholder blocks. Updated Mastercard capitalization and replaced “SMS” with “text message” in several locations throughout guide. Added references to SHAZAM BOLT$ API.

March 3, 2017 Update Added verbiage updates to Access Help section. Added verbiage changes to Features section. March 2, 2017 Update Reformatted “Sample Emails and SMS Alerts” section. Reformatted “Features” section. Added screenshots for SMS alerting section. February, 26, 2017 Update Added new screenshots to Manage BOLT$ and Alerts sections. Added Sample Email and SMS message verbiage. March. 2, 2016 Update Introduction — Updated reference to Transaction Control. A SHAZAM BOLT$ user can now send payments to most cardholders.

Card Actions — Updated reference to Transaction Control (see above).

Revision History Date Action Section and Description of Change

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 90 Oct. 8, 2015 Update Introduction — Added a bullet regarding Transaction Control. Features > Card Actions — Updated to include Transaction Control as an option. Use Transaction Control — New section. On-screen Error Messages — Added a new error message, “Unable to perform balance inquiry, please contact your bank.” Identify Transaction Control Maintenance in SHAZAM Access Transaction Detail — New section.

SHAZAM BOLT$ Denials in SHAZAM Access — Added Action Code 104. Using SHAZAM Reports — Added the FW310-R report and updated the CD200-R report section.

Aug. 20, 2015 Update Manage SHAZAM BOLT$ in SHAZAM Access—New section. SHAZAM BOLT$ Introduction—Added three bullets pertaining to the ability for enrolled cardholders to send money to cardholders from any SHAZAM financial institution. Cardholder Enrollment—Updated steps 1, 4, and 6. Login—Added “Before Login” and “After Login” procedure with screen shots of various possible Cards & Balances screens.

Features > Change Alert Settings—Updated to include “Send Money” feature. Send Money—Updated step 2 to include updated “Send Money” features. Locate ATM—Changed name from “ATM Locator” to “Locate ATM.” On-screen Error Messages—Added two new questions pertaining to Send Money feature. Sample Emails—Updated section with new headings and table of contents for each section. Updated the Activation Email sample. Added the following new email samples: • New Device Alert • SHAZAM BOLT$ P2P Registration Emails (multiple) February 2, 2015 Update Updated Cards & Balances screen graphics to include ATM Locator button.

Updated several sections within the document with updated verbiage based on the new person-to-person (P2P) payments service.

August 20, 2014 Update Updated several sections within the document with new screen shots and updated verbiage based on the new P2P payments service. Revision History Date Action Section and Description of Change

SHAZAM BOLT$ Reference Guide The SHAZAM Network - September 13, 2018 © SHAZAM, Inc. Page 91 August 14, 2013 Update Updated several sections within the document with new screen shots and verbiage based on an enhancement to SHAZAM BOLT$. June 21, 2013 Update Introducing SHAZAM BOLT$—Removed statement that SHAZAM BOLT$ does not operate on VoIP or prepaid devices.

Cardholder Enrollment in SHAZAM BOLT$—Added more detail regarding process, including images. Using SHAZAM BOLT$ Features—Added more details and images for the following two sections: • Change Card Settings • Change User Settings Frequently Asked Questions—New section. February 1, 2013 Update Offering SHAZAM BOLT$ to Your Cardholders—Clarified that this product is not supported for ATM-only BINs.

Troubleshooting SHAZAM BOLT$ Error Messages—Updated Account Locked procedure. November 12, 2012 Update Added a note on page 3 to say that cardholders may only add cards that are accepted at a point-of-sale terminal (which excludes ATM- and savings-only cards). Updated email alert section. May 25, 2012 New reference guide. Revision History Date Action Section and Description of Change

You can also read