Tap to Pay and SoftPOS explained: iPhone, Android, MPoC

SoftPOS (software point of sale) turns an ordinary smartphone, tablet or handheld into a contactless card terminal: the merchant's payment app reads cards and phone wallets through the device's built-in NFC chip, using certified software from a payment provider, with no separate card reader. Apple's version is Tap to Pay on iPhone, available through payment providers in 60 countries and regions as of 3 November 2026, and on Android providers such as Stripe offer Tap to Pay on Android, with security rules set by the PCI Security Standards Council's MPoC standard.

The card schemes also have their own names for it: Visa calls it Tap to Phone. From the shopper's side nothing changes. They tap a card, phone or watch as they would on any terminal.

Who does what in a SoftPOS payment

Sources: Apple Developer; Stripe; PCI SSC, checked 3 November 2026.

Apple's developer page is clear on the division of labour: the payment provider handles certification and security and supplies the certified terminal configuration loaded onto the merchant's device. The rest of the chain is the normal card flow, explained in how card payments work.

How a Tap to Pay payment works, step by step

1. The merchant sets up the app. On iPhone, the merchant downloads a supported payment app, accepts the terms and enables the device. Payments can then start straight away, according to Apple.
2. The app connects to the provider's reader software. Stripe, for example, treats the phone as a "reader" that the app connects to, ideally in the background when the app opens.
3. The merchant enters the amount and starts collection. On Android, Stripe's SDK takes over the screen with a full-screen prompt asking the shopper to tap.
4. The shopper taps. A contactless card, phone or watch is held near the device's NFC antenna. Stripe's SDK can move the on-screen tap indicator to where the antenna sits on that model.
5. Card data is encrypted on the device. On iPhone, Apple says transactions are encrypted and processed using the Secure Element.
6. PIN, if required. Above local contactless limits, or if the issuer asks for strong customer authentication, the shopper may be asked to enter a PIN on the merchant's screen.
7. The provider sends the authorisation. The payment goes to the acquirer, scheme and issuer.
8. The result shows on screen. Control returns to the merchant's app.

Tap to Pay on iPhone

Sources: Apple Developer pages; Apple newsroom, checked 3 November 2026.

Availability has grown quickly. Apple's September 2025 announcement, which added Estonia, Latvia, Lithuania, Monaco and Norway, put the total at 43 countries and regions. Apple's developer page listed 60 when we checked on 3 November 2026.

Tap to Pay on Android

On Android, Tap to Pay is delivered through payment providers' software: Stripe, for example, includes it in its Terminal Android and React Native SDKs. Stripe publishes its device requirements in detail, so we use them here as the example.

Source: Stripe Tap to Pay documentation, checked 3 November 2026.

Stripe lists general availability in 21 countries, including the UK, US, Germany, France, the Netherlands, Ireland and Australia, with a further 19 markets in public preview. It also lists supported phones and devices from Samsung, Google, Motorola, Xiaomi, OnePlus, Oppo and others, plus countertop, kiosk and handheld devices from makers such as Sunmi and Zebra.

PIN entry on a phone

Contactless payments above a local limit need extra cardholder verification. In the EU, Article 11 of Regulation (EU) 2018/389 lets banks skip strong customer authentication only for contactless payments up to EUR 50, and only until EUR 150 or five consecutive contactless payments have built up since the last full check. Beyond that, the shopper needs to verify, typically with a PIN.

Software PIN entry makes this possible on a phone. Stripe supports it on Tap to Pay on Android from SDK version 4.3.0, and Visa's Tap to Phone page describes a customer PIN option. Stripe's documentation sets strict conditions: PIN entry fails if developer options, accessibility services, screen recording or screen overlays are active, or if anyone tries to take a screenshot, and the PIN pad appears at a random position on the screen.

Some cards still cannot be used. Stripe notes that in Canada and Finland many cards are offline-PIN only, which needs the card inserted into a terminal, and that in the UK some issuers may require insertion for strong customer authentication. In those cases a physical reader or a payment link is needed.

The PCI MPoC standard

The PCI Security Standards Council (PCI SSC) published the Mobile Payments on COTS (MPoC) standard on 16 November 2022. COTS stands for commercial off-the-shelf devices, meaning ordinary phones and tablets.

Source: PCI SSC, checked 3 November 2026.

The Council describes MPoC as modular and objective-based, and says it separates development requirements from operational ones. It says two consultation rounds in 2022 produced about 900 pieces of feedback from 37 companies. An MPoC v1.0.1 errata bulletin is linked from the standard's page. The Council also states that compliance programmes are run by the payment brands, so which firms must validate against MPoC is a question for the schemes.

Who offers it

Apple publishes the payment providers that support Tap to Pay on iPhone in each country. Selected markets, as listed on 3 November 2026:

Source: Apple Developer, Tap to Pay on iPhone countries and regions, checked 3 November 2026.

Our profiles of Stripe, Adyen, Mollie, PayPal, Revolut and Worldpay cover each provider's wider in-person products. For how providers and acquirers split the work, see payment gateway vs PSP vs acquirer.

Adoption figures

Sources: Visa Tap to Phone page and 3 March 2025 release; Apple newsroom and developer pages.

Benefits and trade-offs for merchants

SoftPOS tends to suit mobile sellers, pop-ups, delivery staff and shop-floor staff who need a second checkout point. Tokenised phone wallets tapped on a SoftPOS device use the same scheme token services described in our network tokenisation guide. More in the acquiring hub.

Key terms

• COTS: commercial off-the-shelf device, such as a standard phone or tablet.
• CVM limit: the amount above which a contactless payment needs extra cardholder verification.
• MPoC: the PCI SSC standard for PIN and contactless acceptance on the same COTS device.
• NFC: near-field communication, the short-range radio used for contactless payments.
• Offline PIN: a PIN checked by the card chip, which needs the card inserted.
• ProximityReader: Apple's framework for Tap to Pay on iPhone.
• SoftPOS: software that turns a COTS device into a payment terminal.
• Tap to Phone: Visa's name for contactless acceptance on a phone.