SoftPOS: Accepting Card Payments on Phones — How It Works and What to Consider

Accepting card payments used to require dedicated terminals. SoftPOS changes that: with the right software, an ordinary NFC-enabled smartphone or tablet can accept contactless cards and mobile wallets. For small merchants and businesses with mobile staff, that lowers costs and simplifies operations.

How SoftPOS works

1. The merchant opens a payment app on an NFC-enabled phone.
2. The customer taps a contactless card or phone wallet on the device.
3. The app’s certified payment component reads the card data securely and encrypts it.
4. For higher amounts where required, the customer enters a PIN on the screen.
5. The transaction is sent to the payment processor for authorisation.
6. A digital receipt is issued.

Security standards

Because phones are general-purpose devices, payment security relies on software protections, attestation and monitoring rather than tamper-resistant hardware. The PCI Security Standards Council first published standards for contactless payments on commercial off-the-shelf devices (CPoC) and for PIN entry on such devices (SPoC). On 16 November 2022 it published the Mobile Payments on COTS (MPoC) standard, which combines aspects of both and allows contactless card acceptance and PIN entry on the same device. Card schemes and EMVCo also set requirements for contactless kernels.

For businesses, the practical point is to use a provider whose solution is certified under the relevant standards for your markets.

Use cases

Costs compared with traditional terminals

Integrating SoftPOS into your app

• Provider SDK: most businesses integrate a certified SDK from a payment provider into their own app, rather than building payment components.
• Platform features: mobile operating systems offer tap-to-pay capabilities that work with participating payment providers in supported countries.
• Device requirements: NFC support, minimum operating system versions and attestation; check supported devices for your staff.
• App design: clear payment flow, receipts, refunds, offline handling and reconciliation with your orders.
• Testing: use provider sandboxes and test cards across devices.

Risks and limitations

• Device compatibility varies, especially across Android models.
• PIN support and contactless limits depend on provider, scheme and country.
• Connectivity is needed for authorisation; offline options are limited.
• Fraud: rely on provider controls, device attestation and monitoring.
• Compliance: your app integration still needs secure coding and must not capture card data outside the certified component.

Designing the payment experience

• Make the amount and merchant clear before the customer taps.
• Guide the tap: show where the NFC antenna is on the device, which differs by model.
• Handle PIN prompts gracefully with accessible on-screen PIN entry where supported.
• Offer digital receipts by email, SMS or QR code, and printed receipts where customers expect them.
• Support refunds and partial refunds from the same app with appropriate permissions.
• Reconcile automatically with orders, invoices or jobs to avoid manual matching.
• Plan for failures: declined cards, timeouts and lost connectivity, with clear next steps.

Operational considerations

Example: field service payments

A hypothetical home-repair company equips technicians with company phones running its job app. Integrating a SoftPOS SDK lets technicians take payment at the end of each job: the job’s invoice amount is pre-filled, the customer taps a card or phone, and the payment is matched to the job automatically. Office staff no longer chase invoices, technicians no longer carry separate terminals and cash handling falls.

Choosing a provider

• Certification and supported markets.
• Supported devices and operating systems.
• Fees, settlement times and contract terms.
• SDK quality, documentation and support.
• Reporting, refunds and reconciliation features.

Frequently asked questions

Is SoftPOS secure?

Certified solutions use encryption, attestation and monitoring designed for commercial devices. Security depends on using a certified provider and following its integration requirements.

Can SoftPOS accept chip-and-PIN cards inserted into a reader?

No. It accepts contactless cards and wallets; PIN entry on screen may be supported for contactless transactions where allowed.

Do we need PCI DSS compliance?

Using a certified provider reduces your scope, but you still have obligations related to your environment and app. Confirm with your provider and assessor.

Can we build our own SoftPOS?

Building and certifying the payment component is complex and costly; most businesses integrate a provider’s certified SDK.