Bambora in Canada: what you have, and what to check before you change it.

The short answer

• Bambora is now part of Shift4. Shift4 completed its purchase of Bambora North America on 2 March 2026.
• Its web addresses are changing. Integrations must move to new Shift4 addresses before 31 December 2026. Your developer or plugin vendor makes that change.
• The gateway and the processor are separate jobs. Most of what you pay comes from the processing behind the gateway.
• One account, one currency. A Bambora account is set to CAD or USD. A second currency needs a second account.
• Nothing changes until it is checked. Whether you can change processor, keep saved cards or keep recurring billing depends on your account, and we confirm it in writing first.

Your gateway and your processor do different jobs

A payment gateway passes the card details from your checkout to a processor and brings the answer back. The payment processor approves the sale and settles the money into your merchant account, which pays out to your bank.

These can come from one provider or from several. A Bambora account can be sold on its own, for a business that already has a merchant account, or bundled with one. Your statements usually show which you have. If they do not, send us what you have and we will work it out with you. Bambora is one of the gateways we cover.

Where to start

Whatever your situation, we first check who sits behind each part of your setup, from the Bambora product your software uses to who processes your payments, who built your connection and which names appear on your statements.

The Shift4 address change

Bambora's help centre says its API and portal addresses are moving to Shift4 addresses, which have been active since 25 August 2026. Integrations must be updated before 31 December 2026, and hosted checkout links in websites, invoices and emails change too. Bambora says only the address changes, and your credentials and transaction data stay the same.

Ask your developer or plugin vendor to confirm the update for your setup. If you are not sure what you run, we can check your setup with you.

Software that connects to Bambora

Check each connection against the jobs you need it to do: take a payment, save a card, renew a subscription, refund a sale or match a deposit.

3-D Secure 2 on Bambora

Bambora's help centre says 3D Secure 2.0 is available only on some of the processors behind the gateway, that Bambora support must enrol the account, and that the REST API runs the authentication for you, while a server-to-server option exists for merchants with their own Visa Secure, Mastercard Identity Check or Amex SafeKey certification. An optional 3DsecureAuthRequired flag stops the sale unless authentication succeeds. WooCommerce says its Bambora extension does not support it. We check whether your processor qualifies and whether the account is enrolled. Why it matters: card-testing bots run stolen card numbers through online checkouts by the thousand, and Visa's guidance says every attempt, approved or declined, can carry authorization and gateway fees, with disputes on the ones that go through. Visa's merchant guide lists 3-D Secure authentication among the controls, next to CAPTCHA, velocity limits and device checks. Turn it on before the first attack; we check that it is live and that your checkout sends it. See 3-D Secure in Canada, or the sixty-second version.

Stopping card testing on Bambora

Bambora's help centre has its own carding article: automated scripts run stolen card data through an open payment form, and the tells are whole-number amounts and bursts outside your normal volume. Its tools are Risk Thresholds, a score from 0.01 to 100 with a default decline at 60 and warning at 30 that only works when your site passes the customer IP and billing address; blocking of specific IPs and cards; a mandatory billing address; minimum amounts; and, during an attack, switching the payment form off. Several must be requested from Customer Care. We check which are on and whether your checkout sends the IP. Visa's merchant guide lists these controls together with 3-D Secure, and none of them is on by default on a new account. We go through the list with you and turn on what your checkout can use.

Keyed payments and the Web Terminal

Bambora's Web Terminal lets staff key in a card payment from inside the Bambora account, for phone and mail orders. Bambora says it comes standard on most accounts, and the user needs full access to payment processing. If it is missing, Bambora's support team can turn it on.

If most of your payments are keyed in, tell us at the start. It changes how the account should be set up and priced. For the wider picture, see our virtual terminal page or send customers a payment link.

CAD and USD

Bambora says each account has one currency, USD or CAD. A payment through Checkout is charged in that currency, and a second currency needs another account. Foreign cards still work, and the cardholder's bank converts the amount. If you bill Canadian customers in CAD and American customers in USD, check that your software can send each sale to the right account.

VAR sheets and fees

Where CleverPays fits

Shift4 owns and runs the Bambora gateway. The company that processes your card payments approves and settles them. Your software company maintains its own connector. Visa, Mastercard and the other card networks set their own rules. CleverPays does not make Bambora or your software.

We check your setup with you: which gateway account, which processor, which software, CAD or USD, saved cards and recurring billing. Then we tell you what can change. Where we can set up the account, we will say so in writing. Where we cannot, we will tell you. We can review your statement, connect and test what we set up, and stay your contact in English and French.