Secure Remote Commerce (SRC)

Secure Remote Commerce (SRC) is a technical specification published by EMVCo for paying with cards in online and in-app checkouts. It lets a cardholder register their cards once with their card network and then pay at participating merchants by selecting a stored card, instead of typing the card number, expiry date and security code into each website. The consumer-facing brand for SRC is Click to Pay, identified by a common icon shown at checkout.

SRC was developed by the major card networks working through EMVCo, the body they own jointly, to create a standard, interoperable online checkout comparable to the contactless experience in stores. It replaced earlier network-specific wallets such as Visa Checkout and Masterpass. SRC relies heavily on network tokenization and is designed to work alongside 3-D Secure for authentication.

An SRC checkout involves several roles defined in the specification:

• SRC system. Each card network operates a system that stores the cardholder's enrolled cards and profile and returns payment data for a transaction.
• SRC initiator. A merchant, payment service provider or payment gateway that integrates the SRC checkout into the merchant's site or app.
• Digital card facilitator. The component that presents the cardholder's cards, which may be run by the network or by a third party such as an issuer or wallet provider.
• Issuer. The card issuer can enrol cards on the cardholder's behalf and is involved in authentication and authorisation as usual.

When a customer reaches checkout, the merchant's SRC integration checks whether the customer is recognised, for example through a cookie on the device or an email address or phone number confirmed with a one-time code. The customer's enrolled cards are displayed, the customer chooses one, and the SRC system returns a token and cryptogram, or in some cases card data, to the merchant's payment provider. The provider then submits an ordinary authorisation request through the acquirer and network.

SRC improves security in several ways. Payment credentials are typically passed as network tokens rather than real card numbers, so merchants do not store data that could be reused after a breach, reducing their exposure under PCI DSS. Each transaction can carry a dynamic cryptogram that proves the token is being used in an authorised context. The SRC system can also share device and identity information with the issuer, supporting risk-based authentication and frictionless 3-D Secure flows. Later versions of the specification support device-bound authentication, including passkey authentication, so customers can confirm a payment with a fingerprint or face scan.

For cardholders, SRC removes the need to type card details and keeps details up to date automatically when cards are replaced, because tokens are refreshed by the network. For merchants, the main expected benefits are higher conversion at checkout, fewer declines due to outdated card data, and a single integration that covers several networks rather than separate wallets. Issuers gain visibility of more online transactions through their own card brand, compared with third-party wallets that sit between them and the customer.

SRC competes with and complements other ways of paying online. Device wallets, such as those from phone makers, store tokenised cards on the device and use biometric authentication; browser autofill stores card details in the browser; and merchants keep cards on file for their own customers as a card-on-file arrangement. SRC differs in that the card network, rather than the device maker, browser or merchant, holds the cardholder's profile, which in principle lets the same experience follow the customer across merchants and devices.

All of these methods ultimately produce a card-not-present transaction processed through the normal card system, so interchange, disputes and scheme rules still apply.

Adoption of Click to Pay has been gradual. Merchants and payment providers must integrate it and display it prominently, and many customers already use device wallets or stored merchant accounts. Critics have pointed to inconsistent user experiences in early versions, low consumer awareness of the brand and the difficulty of recognising returning users across devices. Networks have responded by enrolling cards automatically through issuers, adding passkeys and promoting SRC as the standard basis for future card checkout, including payments initiated by software agents on behalf of consumers.

• EMVCo