SoftPOS

SoftPOS, short for software point of sale, is a way of accepting card payments in which a standard smartphone or tablet acts as the payment terminal. The merchant installs an app, and customers pay by holding a contactless card, phone or watch against the device. The phone's built-in near-field communication antenna reads the card, and the app sends the transaction to the acquirer. No card reader, dongle or dedicated terminal is involved.

The approach is marketed under names such as Tap to Pay and tap on phone. It extends the idea of the mobile point of sale, which paired a phone with a small external reader, by removing the hardware altogether. It is aimed mainly at small and mobile merchants, and at larger businesses that want staff to take payments anywhere on the premises.

The merchant, or a member of staff, opens the app, enters the amount and presents the phone. The customer taps a contactless card or a wallet on their own device. The app's payment kernel carries out the same exchange with the chip that a physical terminal would, obtaining a one-time cryptogram that proves the card was present. The encrypted data goes to the provider's servers and then through the acquirer and card network to the issuer for authorization. A receipt is sent by email, text message or QR code.

Technically the transaction is an EMV transaction made in card present conditions, so it carries card-present pricing and fraud liability rules. Because there is no chip slot or stripe reader, only contactless payments are possible.

A phone is a general-purpose consumer device, not a tamper-resistant terminal, so security is achieved in software and on the provider's servers. The app is hardened against tampering, sensitive operations are isolated, and a back-end system continuously checks that the device has not been compromised, a process called attestation. If checks fail, the app stops accepting payments.

The Payment Card Industry Security Standards Council has published standards for this model. Contactless Payments on COTS, released in 2019, covered acceptance on commercial off-the-shelf devices without PIN entry. An earlier standard dealt with PIN entry on a phone using a separate secure reader. Mobile Payments on COTS, published in 2022, brings these together in a modular standard that includes PIN entry on the same touchscreen. Solutions are assessed by approved laboratories and listed by the council, and card networks run their own approval programs for providers.

Contactless card payments above a set value normally require cardholder verification. Where the customer pays with a phone or watch, verification has already happened on their device through a fingerprint, face scan or passcode, and no further step is needed. For a plastic card above the contactless transaction limit, the SoftPOS app must be able to capture a PIN on the merchant's screen, often called PIN on glass, using a randomized keypad and other protections. Solutions without this capability are limited to lower-value payments or to wallet transactions.

SoftPOS first became available on Android, where app developers can access the near-field communication hardware. Apple introduced Tap to Pay on iPhone in 2022, offered through payment providers that integrate it into their own apps. Regulatory action in the European Union has since required Apple to give third parties wider access to the contactless hardware on its phones.

Merchants obtain the service from an acquirer, a payment facilitator or a software platform that embeds acceptance in its own product. Behind them are specialist vendors that supply the certified software kit and the monitoring back end. The merchant is onboarded and underwritten as for any other card acceptance.

• Micro and small merchants. Market traders, tradespeople and delivery drivers can accept cards with a phone they already own, avoiding a terminal rental fee.
• Larger retailers. Staff carry devices to take payment in the aisle or at the table, or use them as overflow tills at busy times.
• Transport, events and charities. Fares, tickets and donations are collected on handheld devices.
• Emerging markets. Where terminals are costly relative to merchant income, phone-based acceptance is a way to extend card acceptance.

SoftPOS does not replace every terminal. It cannot accept chip-and-PIN insertions or magnetic stripe cards, which matters where many cards are not contactless. It depends on the phone's battery and data connection, offers no built-in receipt printer and is less robust in heavy use than a purpose-built smart POS. Some customers are also reluctant to tap their card on, or type a PIN into, a stranger's personal phone. Providers must keep pace with operating system updates and withdraw support for older devices that can no longer be secured.

• PCI Security Standards Council
• EMVCo