One-Click Checkout

One-click checkout is a way of buying online in which a shopper who has purchased before can place an order with one click or tap. The payment method, billing details and delivery address were saved during an earlier purchase, so nothing needs to be typed again. Pressing the button both confirms the order and authorises the payment.

The purpose is to remove the steps between deciding to buy and paying. A long or awkward checkout is a leading cause of cart abandonment, particularly on phones, where filling in forms is tedious. One-click purchasing is offered by large retailers on their own sites, by wallets that work across many merchants, and by payment providers as a feature for the merchants they serve.

The idea is closely associated with Amazon, which introduced its 1-Click ordering in the late 1990s and obtained a United States patent on the method in 1999. The patent was controversial as an example of a business-method patent, and Amazon enforced it against a rival bookseller and licensed it to Apple for its online store. While it lasted, other merchants in the United States generally required at least two steps to complete an order. The patent expired in 2017, after which one-step purchasing became widely available.

The first purchase is an ordinary one. The shopper enters card and address details, completes any authentication the card issuer requires, and agrees to have the details saved. The merchant or its payment provider keeps the card as a card on file, in practice as a token and not the card number itself. Where network tokenization is used, the card network keeps the token up to date when the underlying card is replaced.

On a later visit the site recognises the shopper, through a login or a remembered device, and shows a one-click button. Pressing it creates the order with the default address and sends a payment request flagged as a stored credential transaction started by the customer, a customer-initiated transaction. The security code on the back of the card is usually not requested again, since card rules do not allow merchants to store it. Many implementations allow a short window in which the order can be cancelled or edited.

• Merchant accounts. A single retailer stores the details for use on its own site and app. This suits merchants with frequent repeat customers.
• Device wallets. A digital wallet built into a phone or browser supplies the card, address and contact details, with the shopper approving by fingerprint or face. It works even on a first visit to a merchant, which combines the speed of one click with the anonymity of guest checkout.
• Network wallets. Services run by payment providers recognise a shopper across all participating merchants, typically by email address or phone number followed by a one-time code, and fill in the saved details.
• Card network click to pay. The card networks' Secure Remote Commerce standard, presented to consumers as Click to Pay, offers a common button through which cards enrolled with any participating network can be selected.

Removing steps must be reconciled with rules that require the payer to be verified. In the European Economic Area and the United Kingdom, strong customer authentication applies to most online card payments started by the customer, which on its face would add a challenge to every one-click order. Merchants keep the flow short by relying on exemptions for low-value or low-risk transactions, by having the customer add the merchant to a list of trusted beneficiaries at their bank, or by using methods in which the single action is itself the authentication.

Device wallets fall into the last group, since the biometric check on the phone satisfies the requirement. Passkey authentication extends the same idea to the web: the shopper confirms with the device's fingerprint or face reader, and a cryptographic proof is sent with the payment. In markets without such mandates, merchants decide for themselves when to add a check, usually on the basis of a fraud score.

Merchants report higher conversion among returning customers, more frequent purchases and larger shares of sales on mobile devices. Stored credentials also reduce typing errors that lead to declined payments.

The convenience has costs. An account protected only by a password becomes a target: a criminal who takes it over through account takeover can order goods to a new address with no further barrier, so merchants add checks when the delivery address, device or spending pattern changes. Accidental purchases, including by children, generate refunds and disputes. Holding payment credentials brings obligations under the PCI DSS, which merchants limit by leaving storage to their provider. Consumer protection and data protection law require that saving the details is a clear choice, that the final price is shown before the button is pressed, and that customers can remove a saved card.

Wallet-based versions shift the customer relationship toward the wallet provider, which may hold the shopper's details and see their purchases across merchants. Merchants weigh that dependence against the gain in completed orders.