Is SoftPOS the payment industry’s hot new thing?

Conor Devane, MAXSTORE Manager, PAX EMEA

Mark O'Flynn, Sales Director, PAX EMEA

Many articles and press releases have been published around the topic of ‘SoftPOS’, claiming that this new technology - often marketed as ‘Tap to Phone’ or ‘Tap on Phone’ - may radically transform the payments acceptance landscape. Therefore, in this blog we will assess the potential for SoftPOS - highlighting the key merchant tiers, market sectors, and use cases - outlining the pros & cons, as well as presenting the PAX Technology perspective.

PAX has already built a SoftPOS product and aims to offer it to acquirers and merchant service providers who - we predict - will over time be looking to implement a modularised in-house solution, rather than relying on the services of third party SoftPOS providers. (We describe the reasons why at the end of this article).

Similar to the vendor consolidation that occurred with POS terminal manufacturers during the 2000s, the majority of third party SoftPOS providers are likely to disappear, as they either get acquired or go out of business.

We have been closely watching the evolution of SoftPOS over several years and are excited by the potential expansion of the overall size of the card & digital wallet acceptance market.

What is SoftPOS?

SoftPOS describes how a standard off the shelf device - such as a smartphone - can be transformed into a payment acceptance device through the deployment of a mobile app with security controls, backed up with various attestation and monitoring services. Together, this solution allows contactless payment cards or digital wallets to be ‘tapped’ on the smartphone using NFC technology.

Why all the interest?

Consumers appreciate the simplicity and speed of making a contactless payment, becoming the preferred payment method in most countries around the world. Contactless adoption dramatically increased during the COVID-19 pandemic, due to health concerns and through the raising of transaction limits.

More types of businesses or merchants now see the need to accept digital payments due to increased consumer demand and the reduced amount of cash which people carry in their purses or wallets. Indeed, in many developed electronic payments markets, cash has almost become a thing of the past.

A further reason for the increased attention is because Visa and Mastercard are actively promoting SoftPOS technology as they see it as a way to increase the number of electronic transaction acceptance points and thus grow the overall market size they are able to address.

Key merchant tiers, market sectors and use cases

While mainstream businesses do not appear to be much interested in a SoftPOS offering, it does seem to be something which is being targeted at micro-merchants - taxi drivers, tradespeople, festival traders, street food providers, charity collectors, self-employed sales agents - because they require a very basic solution that supports Visa and Mastercard acceptance, and they are not seeking additional payment options nor advanced software application capabilities.

Perhaps small sized merchants (i.e. a tier above micro-merchants) with larger transaction volumes may one day consider SoftPOS as a viable solution, but only if this can match the range of payment methods and functionalities available from new-generation Android-based SmartPOS terminals. They usually want to accept all international payment cards as well as local payment methods - such as debit cards - and access useful features such as gratuities or tipping, Dynamic Currency Conversion, pre-authorisations, and cash advance.

Larger and medium sized merchants are not considered to be prospects for a SoftPOS offering at this stage, because their payment acceptance and system integration requirements are far greater and complex, and because they are now using more advanced apps tailored for Android SmartPOS terminals - such as EPOS solutions, loyalty, stock control, etc.

Higher rates of SoftPOS adoption might occur in countries where the contactless limit is the equivalent of £100 or above, including the USA, Canada, Japan, China, Australia, Singapore, New Zealand, United Arab Emirates, Bahrain, and the UK. Additionally, countries which are under-terminalised in terms of POS devices may be attracted, at least in principle, by what they perceive - perhaps erroneously over the long run - as lower cost SoftPOS solutions.

What does a SoftPOS solution support?

A basic SoftPOS solution supports Visa and Mastercard acceptance for sale and refund transactions through a white label mobile app, with connectivity to an acquiring platform. Because SoftPOS products do not include a printer, an alternative way of providing a customer with a receipt is required, for example via email or text message.

As smartphones are not built to the high security standards required for payment processing, new data security capabilities must be added. These include attestation and monitoring services and key management. Device and merchant management services are also required.

SoftPOS solutions have evolved since their initial launch, with many now offering PIN support to allow higher value transactions to be accepted. Some SoftPOS solutions support an App2App integration option to allow a smartphone to run both EPOS and payment applications, allowing seamless operations.

The SoftPOS certification journey

The PCI Security Standards Council (PCI SSC) has responsibility for developing appropriate security standards. This started with the introduction of the PCI SPoC standard in 2018 which allowed a smartphone to be paired with an external hardware card reader - such as an mPOS dongle - and for the PIN to be securely entered onto the phone’s touch screen display.

In 2019, the PCI CPoC standard was released, allowing cards to be read by the NFC reader on consumer off the shelf technology (COTS) products, but this did not support any form of PIN verification. In response to market demand for PIN, Visa and Mastercard developed proprietary programmes in 2021 to allow PIN to be offered by SoftPOS products as part of product trials and under payment network restrictions.

In November 2022, the new PCI MPoC standard was published. This builds on experiences learnt from SPoC, CPoC and network trials and includes support for PIN. MPoC introduces a single certification for all international payment networks and the option for certification modularity. To quote Andrew Jamieson, Vice President Solutions at PCI SSC, in a recent press release published by Finextra: “It’s hard to say what the future of payments will be, but we know that payments can’t be a one-size-fits-all. There will continue to be a place for dedicated payment terminals, but increasingly there is a place for other types of solutions as well”.

Advantages of SoftPOS when compared to alternatives

New micro-merchants, in particular, could convert their existing smartphones into a payment acceptance device, lowering their initial upfront cost and accelerating the time it takes to accept their first electronic transaction. For seasonal businesses it likely means that no long-term contracts nor minimum monthly volumes will be necessary to recover hardware costs. For larger established merchants, SoftPOS solutions could possibly provide a helpful backup capability or additional acceptance point during busy trading periods.

Early mPOS implementations, which had followed the SPoC standard, can now be improved by removing the need for micro-merchants to carry a separate mPOS card reader and to pair this via a smartphone’s Bluetooth - something which often created operational challenges for merchants and customer disruption.

Disadvantages of SoftPOS when compared to Android SmartPOS

SoftPOS solutions use inherently less robust and reliable hardware, adding to a higher overall total cost of ownership - over the medium to long-term - when compared to Android SmartPOS. As described below, the perceived lower cost of upfront hardware investment is replaced, over time, by onerous financial investments in mobile app & software subscription-type fees, mandatory re-certifications, the management of attestation & monitoring platforms, etc.

• Due to architectural constraints, transaction processing speeds are noticeably slower compared to new-generation Android SmartPOS, leading to customer delays.
• A shorter battery life on COTS devices presents significant operational challenges.
• The range of payment methods and features supported by SoftPOS are fewer than with Android SmartPOS products.
• Offline PIN verification cannot be supported by SoftPOS solutions.
• Because SoftPOS solutions rely on general purpose consumer hardware devices, these are not only susceptible to theft, but also lack the security & payment industry certifications inherent in dedicated POS and Android SmartPOS terminals.
• Small business owners are also unlikely to want to leave their smartphone in the store when they go out for lunch or take a day off. This likely restricts SoftPOS to single staff-owner operated micro-merchants.
• Android SmartPOS terminals will continue to offer merchants - via the payment service providers who serve them - with a broader range of payments capabilities, system integration possibilities, and value added apps when compared to SoftPOS.
• Acquiring banks and their resellers - ISOs and Payment Terminal Service Providers - will need to compensate for the lack of built-in smartphone security controls and an ‘unhardened’ Android operating system, by operating costly attestation and monitoring services as well as facing higher costs from needing to support the vast number of handset manufacturer and model variations. They will also need to manage Google app store deployment and ongoing scheduled app updates.

The PAX perspective

We have been closely watching the evolution of SoftPOS over several years and are excited by the potential expansion of the overall size of the card & digital wallet acceptance market.

The addition of more micro merchants certainly creates new opportunities for Android SmartPOS device sales as transaction volumes increase and merchants seek out more advanced capabilities. As the world’s leading provider of payment acceptance devices for merchants, this is positive news for PAX Technology.

Our R&D teams have built a SoftPOS product, using our proven contactless kernels, payment securityunderstanding, Android experience and market leading MAXSTORE app & device management platform. The PAX SoftPOS solution is initially targeted at the North American market and, now that the MPoC standard has been published, we are enhancing our SoftPOS offering and aim to achieve PCI MPoC certification during 2023.

The majority of SoftPOS solutions being marketed have been developed, and are operated by, third party providers & processors. Acquirers are currently using them to learn more about SoftPOS, to test the market, and to demonstrate their innovative streak. However, as the number of apps, merchants, and transaction volumes grow, these will become uncompetitive due to high application licences and transaction-based pricing methodologies. In future it is therefore highly probable that merchant service providers will seek a modularised in-house solution that makes greater usage of their in-house acquiring platform capabilities. PAX Technology will offer a product that meets this need.

Nobody expects SoftPOS to replace Android SmartPOS products. The two product categories address very different segment needs and can happily co-exist. Android SmartPOS will continue to deliver far more capabilities, process transactions faster, offer operational advantages and have security built into the hardware rather than trying to protect an insecure COTS device such as a smartphone or tablet.

The global PAX community looks forward to discussing the value we can deliver to you from our advanced products and services. Please do get in touch to arrange a conversation and demonstration.