How a virtual POS works
A member of staff signs in to the provider's page, enters the amount, the card number, the expiry date and usually the security code read out by the customer, and submits. The payment is authorised like any other card-not-present payment and appears in the same reports.
The PCI Security Standards Council's glossary describes a virtual payment terminal as web-browser-based access to an acquirer, processor or third-party service provider website, where the merchant manually enters payment card data. Unlike a physical terminal, it does not read data directly from a card.
Where a virtual POS is used
- Phone and mail orders (MOTO)
- Hotels, clinics and service firms taking deposits
- Call centres and back offices collecting invoices
- A fallback when a card reader fails
Risks and rules for a virtual POS
Nobody authenticates the cardholder on a keyed payment, so the merchant usually bears the fraud losses, and acquirers often limit who may key payments. The computers used are within the merchant's PCI DSS assessment, and PCI SSC's glossary ties the term to a self-assessment questionnaire of its own, SAQ C-VT. Many merchants now send a payment link instead, so that the customer types the card details and authenticates.
Virtual POS, SoftPOS or payment link?
- SoftPOS
- Software that lets a phone read a contactless card in person. A virtual POS reads nothing: the details are typed.
- Payment link
- Sends the customer to a page to pay and authenticate in person. With a virtual POS, staff enter the details for the customer.
- Payment gateway
- Takes payments from a website's checkout automatically. A virtual POS is the gateway's manual screen.
Where a virtual POS shows up in a platform
Modules that do the work
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Merchant onboardingBusiness sign-up, verification and underwriting, from application to first payment.
- BackofficeOne console to run the platform: customers, money, risk, content and staff permissions.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.