A forgotten merchant password should not lead to repeated payment attempts or accidental changes to your receiving account. Trust Gateway offers an email reset flow for account access. This guide explains what to enter, what the confirmation means and how to investigate a missing message without sharing private reset links.
- Open the official sign-in page and select Forgot password.
- Enter the email address registered on your account.
- Open the reset email and choose a new password within the link's validity period.
- Return to sign-in and check that you reached the intended merchant account.
Use your account email address
Start at Trust Gateway sign-in, then choose Forgot password?. The recovery form asks for your account email address. Even if you usually sign in with a username, use the email associated with that merchant account for recovery. Remove accidental spaces and check the spelling before submitting.
The response deliberately says that a message will arrive if the email belongs to an account. It does not reveal whether an arbitrary address is registered. A confirmation on this form therefore means the request was processed; it does not by itself prove account ownership or successful inbox delivery.
If the message has not arrived
Check the exact inbox you entered, including spam and other filtered folders. Search for a Trust Gateway password-reset message and inspect its destination account if you use several inboxes. A purchase notification, payment receipt or welcome email is not a password-reset link. Open the relevant recovery message rather than forwarding a collection of account emails to someone else.
Allow time for delivery before repeatedly submitting the form. The current flow limits repeated requests and spaces reset generation for the same account. Repeated clicks do not guarantee faster delivery and can make it harder to identify the relevant message. If the form reports too many requests, wait before trying again.
A delayed message can indicate delivery or mailbox filtering trouble, but it can also result from using an address that is not attached to the account. Verify the address first. If you still have access through another supported sign-in method, inspect your profile's registered email rather than guessing variations.
Check the reset link before entering a password
Open a reset link only when you expected the request. Check the browser's actual address and ensure that you are on the Trust Gateway domain before entering a new password. Do not treat a sender's display name or a familiar logo as sufficient proof that a link is genuine.
The link contains a private recovery token. Do not post the complete URL in screenshots, public issue trackers, chats or support requests. Someone with a valid recovery link may be able to act on the account. Support can investigate delivery using a timestamp and account context without needing your new password or a copied reset token.
Understand expiry and single-use behaviour
The current reset flow creates links with a thirty-minute validity period. A successfully used link cannot be used again, and completing a reset invalidates other unused reset records for that account. If you open a stale email after resetting the password, an invalid-or-expired message is expected.
If a link expires before use, request a fresh recovery email and use the newly issued link. Repeatedly opening the expired message will not extend its lifetime. Choose a unique password; the current form requires at least eight characters, but meeting the minimum does not make a reused password a good choice. Keep it in your own password manager rather than a project file.
Confirm access after the reset
After the password is updated, return to the sign-in page and use the new value. If your browser auto-fills an older password, replace that value before concluding the reset failed. Confirm the merchant name and account email in the dashboard so you do not accidentally inspect a different account that was already open in another tab.
A password reset changes the login password. It is not an API-key rotation, a receiving-account update or proof that every previous browser session has been revoked. If you suspect broader account compromise, review your integrations and contact support about access recovery. Do not assume that resetting one credential replaces every credential used by the business.
Separate login issues from payment issues
| Problem | Relevant next step |
|---|---|
| Forgotten login password | Use the account email recovery flow |
| Server receives an invalid API-key response | Check private API configuration and key status |
| Payment remains pending | Investigate the gateway order and receiving evidence |
| Wrong brand on checkout | Check the merchant's checkout branding settings |
Resetting a password should not be used as a trial-and-error fix for a customer's payment status. Keep their order reference and check verification separately. The API-key guide explains server credentials, while the payment-status guide covers pending and confirmed orders.
Send useful support details
If recovery still fails, describe the time of the request, whether the form showed an error, whether any reset email arrived and whether the link expired before use. Hide passwords, reset URLs and private email content in screenshots. These facts help distinguish a form problem from delivery delay or an already-consumed link without exposing the account's recovery secret.