Checkout

In payments and commerce, checkout is the stage of a purchase at which the customer confirms what is being bought and pays for it. In a physical shop it is the till or self-service terminal. Online, it is the sequence of pages or screens that follows the shopping cart, where the buyer enters contact and delivery details, selects a payment method and authorizes the payment. The word is also used for the software product that provides those screens, which payment companies sell to merchants.

Checkout is where a merchant's website meets its payment provider. Its design affects how many shoppers complete their orders, which payment methods can be offered, how much of the security burden falls on the merchant, and how much fraud gets through. For these reasons it receives more attention than any other part of an online payment integration.

A typical flow collects information in stages, though many merchants compress them into one page.

• Identification. The buyer signs in to an account or continues without one through guest checkout.
• Delivery and tax. The buyer gives an address and chooses a shipping option, and the system calculates taxes and the final total.
• Payment method. The page shows the methods available for the buyer's country and currency: cards, wallets, bank transfers, instalments and any local payment method.
• Payment details and authentication. The buyer enters or confirms details, and may be asked by their bank to verify the payment.
• Confirmation. The merchant shows the result and sends a receipt.

Behind the page, the merchant's server creates a payment with its provider, the customer's details are sent directly from the browser or app to the provider, a fraud check runs, and the request for payment authorization goes to the card network or other scheme. The provider reports the outcome to both the page and the merchant's server.

Merchants choose among several ways of building the payment step. In a hosted checkout, the buyer is redirected to a payment page on the provider's domain and returned afterwards. In an embedded checkout, the provider's payment fields appear inside the merchant's own page, usually in frames served by the provider, so that the buyer never appears to leave. A direct integration, in which the merchant's own systems receive raw card numbers and pass them on, gives the most control and carries the heaviest compliance burden.

Platforms and marketplaces often use a checkout supplied by their e-commerce software, and businesses without a website can take payment through a payment link that opens a hosted page.

Any merchant that accepts cards must comply with the PCI DSS, and the type of checkout largely determines how much of the standard applies. Where card details are entered only into fields served by a certified provider, the merchant's systems never handle them and the assessment is short. The provider returns a token in place of the card number, a process known as tokenization, which the merchant can store for later charges.

The standard also requires merchants to control the scripts that run on payment pages, a response to attacks in which criminals insert code into a checkout to copy card details as they are typed. In Europe and some other regions, card payments above low values must go through strong customer authentication, which the checkout handles by invoking the issuer's verification step. Checkout is also where fraud screening gathers its signals, including device data, typing behaviour and mismatches between billing and delivery details.

The share of shoppers who start checkout but do not finish is measured as checkout abandonment, a component of cart abandonment. Common measures to reduce it include fewer fields, clear error messages, showing the total cost early, and layouts designed for phones. Accelerated options let returning buyers skip data entry: a digital wallet button supplies card and address in one step, and one-click checkout services recognize the buyer across merchants.

For international sales, the checkout adapts to the buyer's location. It translates the page, shows prices in the buyer's presentment currency, and reorders payment methods so that the locally preferred ones appear first. Where a merchant passes on the cost of acceptance, the checkout is also where any surcharge must be disclosed.

At the point of sale, checkout has also changed. Self-service tills, staff carrying handheld devices, phones used as terminals, and shops where customers scan items in an app have reduced reliance on fixed counters. Retailers increasingly run store and online checkouts on one platform, so that a card saved online can be used in a shop, an online order can be refunded at a till, and sales are reported together.

Card networks have promoted a common online checkout button based on the EMV standard for Secure Remote Commerce, which lets a cardholder pay with stored credentials without typing a card number. Payment providers and technology companies are also building ways for software assistants to complete purchases on a user's behalf, which moves the checkout from a web page to an exchange between systems.