Tap to Pay
Tap to pay, in its acceptance sense, is the use of an ordinary smartphone as a card terminal — the customer taps a contactless card or phone on the merchant's phone, whose NFC chip reads it and whose certified software does the terminal's EMV and security work, with no separate reader. Apple's Tap to Pay on iPhone and the Android SoftPOS products before it made the mPOS reader optional.
- Also known as
- Tap to Pay on iPhone, Tap on Phone, SoftPOS, Phone-as-terminal
- Used at
- small merchants, delivery and field services, pop-ups, queue-busting in large retail, transport, and anywhere a dedicated terminal is a cost or an inconvenience; offered through PSPs and facilitators (Stripe, Adyen, Square, SumUp and others) on iPhone and Android
- Binding
- the schemes' tap-on-phone programmes and EMVCo's specifications; PCI's Contactless Payments on COTS (CPoC) and Mobile Payments on COTS (MPoC) standards for the software's security; Apple's platform terms for Tap to Pay on iPhone, opened to third-party apps in the EU under the DMA
- Typical mechanics
- the phone's NFC reads the contactless card; a secure software kernel runs the EMV transaction and encrypts the data; PIN entry on the phone's screen ("PIN on glass") under the MPoC standard for amounts above the contactless limit; attestation and monitoring services verify the phone and app are untampered
- Typical economics
- no hardware cost, the same facilitator pricing as a reader, and onboarding in minutes inside the PSP's app; the reader business shrinks, the acceptance market grows
- Parties
- the platform (Apple, Google), the PSP or facilitator whose app is certified, the schemes and PCI, the merchant with a phone, and the customer who taps
How tap to pay works in practice
A plumber finishes a job and opens her payments app on her phone. She enters €180; the app shows "hold the customer's card near the top of your phone"; the customer taps his card, or his own phone; the plumber's phone reads it over NFC, the app's secure kernel completes the EMV exchange, the transaction is sent to the PSP's acquirer and approved; a receipt goes to the customer by SMS. No reader, no dongle, no charging cable in the van. For a €180 sale above the contactless limit the customer would enter his PIN on the plumber's screen, which the MPoC standard permits with software attestation in place of a hardware keypad.
The regulatory work was in making a consumer phone trustworthy as a terminal: the PCI standards define what the software must do (isolate the payment kernel, attest the device, detect tampering and rooting, monitor continuously), the schemes certify the solutions, and the platforms expose the NFC and, on iPhone, the secure element. Apple's version launched in the US in 2022 and spread market by market; Android's had been available since 2019 through several vendors. The DMA's opening of iPhone NFC in the EU let third-party apps offer it there without Apple's own programme.
For the mPOS providers, tap to pay is the reader's successor and the reader's end; for the facilitators, a product that removes the last friction from onboarding; for payments M&A, the SoftPOS software vendors were acquired by terminal makers and PSPs between 2020 and 2024.
Example
A facilitator with 400,000 reader-based merchants launches tap to pay in its app. In the first year 150,000 new merchants onboard with no hardware — acquisition cost down from €40 (reader subsidy plus shipping) to €6 — and 30% of existing merchants use tap to pay alongside or instead of their readers. Reader shipments fall 55%; the facilitator's hardware losses fall by €5m a year; its merchant count grows faster than at any time since 2015. Its PIN-on-glass certification took nine months and €1.5m; the monitoring service that attests every phone costs €0.02 per transaction. A terminal manufacturer that supplied its readers loses the account and buys a SoftPOS vendor.
Common mistakes
- Assuming a phone can be a terminal without the certified kernel and attestation; an uncertified app is a scheme violation. - Launching in markets where the platform's NFC or the scheme's programme is not yet available. - PIN on glass without the MPoC certification, so transactions above the contactless limit fail. - Reader economics carried into a reader-less product. - Merchants using a personal phone with no device policy, and a lost phone that was also the till.