A payment terminal is the device a merchant uses to accept a card or mobile payment in person. It reads the payment credential from a chip card, a contactless card, a phone or a watch, asks the customer to confirm the payment where required, and sends the transaction data to the merchant's acquirer or processor for approval. Shops, restaurants, taxis, petrol stations, parking machines and market stalls all use them.
The terminal is one part of a wider point of sale (POS) set-up, which also includes the till software, the receipt printer and the merchant's stock and accounting systems. Terminals are built to standards set by EMVCo for card data and by the PCI Security Standards Council for physical and PIN security, and they are usually supplied by an acquirer, a bank or an independent terminal company rather than bought directly from the manufacturer.
Payment terminal in plain terms
Think of a payment terminal as a translator standing between the customer's card and the bank. The card speaks in a secure code, the bank speaks in another, and the terminal reads one, packages it up safely and passes it on, then reads back the answer: yes or no.
Like a ticket barrier at a train station, the terminal does not decide on its own whether someone may pass. It checks that the ticket is genuine, asks the central system, and then opens or stays shut. The money itself moves later, behind the scenes, between the banks involved.
How a payment terminal works
A modern terminal combines several readers and secure components in one housing:
- A contact reader for the EMV chip, which runs a cryptographic conversation with the card so that copied data cannot simply be replayed.
- A contactless antenna using near field communication (NFC), which lets cards, phones and wearables pay with a tap.
- A magnetic stripe reader, kept as a fallback for older cards in markets that still issue them.
- A PIN pad with tamper-resistant hardware that encrypts the PIN the moment it is typed.
- A network link (Ethernet, Wi-Fi or mobile data) to reach the acquirer or payment processor.
When the customer pays, the terminal selects the right card application, reads the card data, decides whether a PIN, signature or no verification is needed, and builds an authorization request that carries the amount, the merchant's merchant identification number (MID), a terminal ID and a one-time cryptogram from the chip. The acquirer forwards the request through the card networks to the card issuer, which approves or declines it. Approved transactions are batched and later cleared and settled, as described in authorization and settlement.
Types of payment terminal
- Countertop terminals. Fixed devices connected by cable, common in supermarkets and pharmacies, often paired with a separate customer-facing PIN pad.
- Portable and wireless terminals. Battery-powered devices that a waiter can carry to the table, connected by Wi-Fi, Bluetooth or a SIM card.
- Integrated or "smart" terminals. Android-based devices that run the merchant's own apps (ordering, loyalty, stock) alongside the payment application.
- Unattended terminals. Readers built into vending machines, fuel pumps, ticket machines and car parks, where no cashier is present.
- Card readers for phones. Small readers that pair with a smartphone or tablet, and "tap to phone" software that turns the phone itself into a contactless reader; both are covered under mobile point of sale (mPOS).
Online sellers do not use a physical terminal. Their equivalent is a payment gateway or, in some markets, a bank-issued virtual POS, and their transactions are classed as card not present (CNP) rather than card present (CP).
Security standards and certification
Terminals handle card numbers and PINs, so they are among the most tightly certified devices in payments. Each model typically needs:
- EMVCo approval of its contact and contactless kernels (Level 1 for the hardware interface, Level 2 for the application logic).
- Approval under the PCI PIN Transaction Security (PTS) Point of Interaction requirements, which test tamper resistance and PIN protection.
- Card-network certification of the full payment application with a specific acquirer (often called Level 3 testing).
Merchants that use terminals still fall within the scope of the Payment Card Industry Data Security Standard (PCI DSS). Terminals that encrypt card data inside the reader using a validated point-to-point encryption solution can shrink that scope considerably, because the merchant's own systems never see readable card numbers. Criminals still target terminals: tampered or swapped devices are a known channel for card skimming, so merchants are expected to inspect their devices and keep an inventory of serial numbers.
Who supplies terminals and what they cost
In most countries a merchant obtains a terminal as part of a package with its merchant account. The acquirer, a retail ISO or a payment facilitator supplies the device, loads the encryption keys and configures it for its own processing platform. The merchant may buy it outright, rent it monthly, or receive it free in return for higher per-transaction pricing. In Nigeria, terminal deployment is a licensed activity of its own, handled by a payment terminal service provider (PTSP).
Running costs usually include the merchant discount rate on each sale, any rental, and network or SIM charges for wireless devices. Because terminals are tied to one processor's keys and software, switching providers often means swapping hardware, which is one reason why software-based acceptance on ordinary phones has grown since the early 2020s.