Virtual POS

A virtual POS (also written VPOS or virtual point of sale) is software that lets a merchant accept card payments without a physical payment terminal. The customer's card details are entered on a web page, in an app, or by the merchant on the customer's behalf for phone and mail orders, and the virtual POS sends the transaction to the acquiring bank for approval. Online shops, booking sites and other businesses that collect payments remotely use it.

The term is used most in Turkey (where it is called sanal POS), parts of Europe, Latin America and the Middle East, where banks traditionally offered e-commerce acceptance as an extra "terminal" on the merchant's account. In the US and UK the same function is more often called a payment gateway or a "virtual terminal". All such payments are card not present (CNP) transactions and follow the card schemes' online rules.

A physical card machine sits on the shop counter. A virtual POS is the same machine with the plastic box taken away: the "keypad" becomes a form on a website, and the "card slot" becomes the customer typing in the card number and security code.

It is a bit like a bank opening a small window for the shop on the internet. The customer walks up to the window (the payment page), hands over the card details, the bank checks with the customer's own bank, and the window says yes or no. The shop then ships the goods, knowing the money will arrive in its account.

1. The merchant integrates the bank's or provider's virtual POS into its checkout, usually by redirecting the customer to a hosted payment page or by embedding a payment form through an API.
2. The customer enters the primary account number (PAN), expiry date and card verification value (CVV).
3. The virtual POS normally starts 3-D Secure (3DS), so the card issuer can authenticate the cardholder with a one-time code, an app approval or biometrics.
4. An authorization request goes through the card networks to the issuer, which approves or declines it.
5. The merchant either captures the payment at once or later (for example on dispatch), and the funds settle to the merchant's account after the usual cycle.

Many virtual POS products also offer a manual entry screen for telephone and mail orders (often labelled MOTO), recurring billing, refunds and links that can be sent to a customer by email or messaging app.

The difference between a virtual POS and a gateway is mainly one of origin and contract. A bank-issued virtual POS is tied to that bank's acquiring business: the merchant has a direct merchant account with the bank and the virtual POS is one more terminal ID under its merchant identification number (MID). A gateway may be run by a technology company that connects to several acquirers.

In Turkey, small merchants often reach bank virtual POS services through licensed payment institutions that combine several banks' virtual POS connections behind one integration, and that may act as a payment facilitator for merchants too small to get a bank contract of their own. This resembles the role a payment service provider (PSP) or payment orchestration layer plays elsewhere. Turkish banks also commonly use the virtual POS to offer instalment payments on credit cards, a widespread feature of card spending in that market.

Because the card is never physically present, a virtual POS carries more fraud risk than a chip transaction. Key controls include:

• Cardholder authentication. In the EU and UK, most online card payments require strong customer authentication (SCA), usually delivered through 3DS; in other markets its use depends on the issuer, the acquirer and the merchant's fraud strategy.
• Data security. Merchants must meet the Payment Card Industry Data Security Standard (PCI DSS). Using a hosted payment page keeps card numbers off the merchant's own servers and reduces the assessment burden.
• Fraud screening. Checks on IP address, device, order value and repeated attempts help spot card testing fraud and stolen cards; see fraud detection.
• Clear descriptors. A recognisable billing descriptor on the cardholder's statement reduces "I don't recognise this" disputes that turn into a chargeback.

Card-not-present transactions generally attract higher interchange and a higher merchant discount rate than in-store payments, reflecting the higher fraud and dispute risk, and the merchant usually bears the cost of fraud chargebacks unless the transaction was authenticated with 3DS, in which case liability for most fraud disputes generally shifts to the issuer. A single-bank virtual POS can also lock a merchant into one acquirer's pricing and approval rates, which is why larger merchants often connect to several and add payment routing on top.

• EMVCo: EMV 3-D Secure
• PCI Security Standards Council