SoftPOS can lower the cost of payment acceptance and bring merchants online faster. To scale it safely, banks need continuous monitoring, central control and a clear response when a device presents a risk.
SoftPOS is becoming a mainstream payment channel. In March 2025, Visa reported that Tap to Phone adoption had grown 200% worldwide over the previous year, with nearly 30% of sellers identified as new small businesses. A compatible smartphone can now accept contactless payments without a separate terminal, reducing the cost and delay involved in bringing a merchant online.
That convenience changes how banks and merchants manage security. A traditional terminal is designed for one purpose and normally remains under the control of the bank or acquirer. A smartphone is used for many tasks. Its owner can install applications, change settings and update the operating system. The device may also be lost, stolen or kept in service after security support ends.
This does not make SoftPOS inherently less secure than a traditional terminal. Physical terminals can also be damaged, replaced or tampered with. The difference is that SoftPOS depends more heavily on the bank's ability to check the device, keep the payment application current and respond quickly when something changes.
Where security exposure becomes a business problem
A security weakness can affect much more than a single transaction. An altered device, an unofficial application or a missed update may create an opportunity for fraud. Poor merchant checks can allow the service to be used by a business that should not have been approved. Unclear responsibilities between the bank and its technology provider can delay the response when an alert is raised.
The commercial effect can be just as serious. A merchant may stop using the service if payments are interrupted without explanation or support is slow to respond. Customers may hesitate if the payment screen looks unfamiliar, the amount is unclear or the transaction produces no immediate confirmation. Once confidence falls, a low-cost acceptance service becomes harder to scale.
Payment standards now reflect this broader view of security. The PCI Security Standards Council began the sunset period for its earlier mobile-payment standards in May 2026. The industry is moving towards Mobile Payments on Commercial off-the-Shelf, or MPoC, which assesses the complete mobile-acceptance service rather than treating the application as an isolated component. For banks, certification is the starting point. The service must remain secure as devices, software and operating systems change.
Why SoftPOS can improve security control
SoftPOS is not automatically better than a traditional terminal in every respect. Its advantage is the speed and consistency with which a bank can manage a large network. Software and security updates can be distributed remotely, without recalling physical terminals. Banks can maintain a current view of active merchants, supported devices and application versions, then apply the same security rules across the estate.
Continuous monitoring is central to this model. The platform should check whether a device still meets the bank's requirements and identify signs that it has been altered or compromised. Depending on the risk, the bank may ask the merchant to update the device, block a transaction, raise an alert or disable payment acceptance. Real-time visibility also gives support teams the information they need to explain the issue and help the merchant resolve it quickly.
BPC SmartVista SoftPOS supports this approach through central device and application management. Banks can monitor the merchant network, manage software releases, receive risk alerts and remove access remotely when necessary. A central record of changes and actions also helps security and support teams investigate incidents without disrupting every merchant on the service.
The model can reduce hardware exposure as well. The merchant does not need a separate card reader for contactless transactions, leaving one less device to distribute, maintain, lose or tamper with. This does not remove the need for security controls, but it gives the bank a more direct way to manage them through software.
What are the benefits for acquirer and their merchants
For merchants
For acquiring banks
For customers, contactless acceptance keeps the card in their hands and removes the need to pass it to the merchant or place it in an unfamiliar reader. A recognisable payment screen, clear amount, secure PIN entry when required and immediate confirmation all help customers understand what is happening. These visible elements matter because trust depends on both the underlying controls and the experience at the point of payment.
Security that supports growth
A bank can only scale SoftPOS confidently if it can see what is happening across the merchant network and act when a risk appears. Certification provides an assessed foundation. Merchant checks, supported-device policies, remote updates, continuous monitoring and responsive support keep that foundation in place after launch.
BPC brings these capabilities together within SmartVista SoftPOS, helping banks expand payment acceptance while retaining operational and security control. BPC's Essential Guide to Powering Your Merchant Network with SoftPOS explains the questions banks should ask when selecting a provider, choosing a deployment model and preparing the service for growth.
Frequently asked questions
What is SoftPOS
SoftPOS is software that allows a compatible smartphone or tablet to accept contactless payments without a separate payment terminal. Depending on the solution and market, it may also support PIN entry, digital receipts, refunds and other merchant services.
Is SoftPOS secure
SoftPOS can provide secure payment acceptance when the complete service is properly assessed and managed. Banks should look beyond certification and confirm how the provider checks devices, distributes updates, monitors risks and responds when a device no longer meets security requirements.
Is SoftPOS more secure than a traditional payment terminal
Neither model is free from risk. Traditional terminals can be lost, damaged or tampered with, while smartphones require continuous checks because their software and operating systems change. SoftPOS can give banks an advantage through faster remote updates, central security policies and better visibility across the merchant network.
What should a bank look for in a SoftPOS provider
Banks should assess certification, device-integrity checks, remote application management, monitoring, risk alerts and the ability to disable a device. They should also review merchant onboarding, reporting, support arrangements and the division of responsibility when an incident occurs.