Introduction

SoftPOS has left the lab. What begana few years ago as a promising but experimental way to accept contactlesspayments on ordinary smartphones has become a certified and rapidly scalingsegment of the payment acceptance market. SoftPOS is not a curiosity making theheadlines anymore, but a live product category with advanced payment features,and its own solution and challenger hardware vendors competing head-on withincumbent terminal manufacturers.

Yet the category carries a namingproblem that has quietly shaped how the market talks about it. “SoftPOS” isoften shorthand for “no dedicated hardware required”, as if the technology'sentire value proposition were the absence of a device. It isn't. SoftPOS is,first and foremost, a shift in where security lives: in the application and theback end rather than in a certified, tamper-resistant payment module. What deviceyou then choose to run that application on is a separate, and just asimportant, decision.

This distinction matters becauseSoftPOS is genuinely a driver of affordable digital payment acceptance — thatpart of the story is true. But it is equally, and far less often discussed, anenabler of innovation, agility, and user experience. Treating it purely as acost play equals missing opportunities.

This paper does not add another SoftPOS growth predictionto the pile. Instead, it looks at the structural drivers behind SoftPOSadoption, dismantles the “no hardware” myth with nuance, and lays out apractical framework for matching device choices to actual business needs.

A brief refresher: what is actually a SoftPOS?

At its core, SoftPOS means acceptingcontactless payments without a traditional, purpose-built payment device (anEFTPOS or SmartPOS terminal). The card-present transaction is enabled throughthe NFC controller of a Commercial Off-The-Shelf (COTS) device — typically asmartphone or tablet — running a certified SoftPOS payment App.

1. A different security model

Traditional SmartPOS terminals build security into the hardware: a tamper-resistant secure element, physical intrusion detection, and closed, proprietary firmware. SoftPOS moves that responsibility into software: application-level protections (white-box cryptography, code obfuscation, anti-tampering), continuous back-end attestation and runtime integrity monitoring, a secure communication channel, and a controlled onboarding process for every device and merchant.

To use a common analogy from the world of security architectures, an EFTPOS follows the fortress model: a heavily protected environment with a clearly defined security perimeter, virtually impenetrable walls, limited access and strict controls at every entry point.

A SoftPOS deployment, by contrast, is more like an airport. People with different backgrounds move freely through much of the facility, yet security is enforced through distributed, layered and continuous controls. Sensitive areas—such as the tarmac and the aircraft themselves—remain subject to the highest levels of protection. Similarly, in a SoftPOS architecture, critical operations like the protected PIN pad rendering are isolated within a highly secure enclave such as a Trusted Execution Environment (TEE) on Android, while the rest of the device remains accessible for general-purpose use.

2. A dedicated certification framework

This is where discussions get technical, and where comparisons between SoftPOS and EFTPOS can create some confusion. From a security perspective,

• PCI MPoC (Mobile Payments on COTS) certifies the SoftPOS software architecture — the application, the SDK, the secure channel, the back-end services.

• PCI PTS certifies the SmartPOS physical device.

These are not competing standards; they certify two entirely different security objects.

A softPOS solution can run on an infinite variety of hardware precisely because the security and the certifications travel with the software, not with the box.

By combining the previously independent CPoC (Contactless Payments on COTS) and SPoC (Secure PIN on COTS) standards, MPoC provides a unified framework that covers trusted PIN authentication.

EMV focuses on the interoperability between the payment method — a physical or tokenized card — and the acceptance solution. SoftPOS certification currently covers NFC acceptance only — chip-and-PIN via contact or magnetic stripe are out of scope by design. The EMV Level 2 kernel that processes the contactless transaction runs inside the SoftPOS App itself, rather than in a firmware embedded in the device. Nevertheless, EMVCo released a new test process for SoftPOS hardware in September 2024 — the “Reduced Range (RR) Level 1 Type Approval” — to confirm the performance of the device’s NFC platform.

3. Why SoftPOS changes the game

Hardware-agnostic,

not hardware-averse

The software runs on a broad range of COTS and professional devices rather than being locked to one manufacturer's box.

Deployment speed

and agility

Software and cloud-based rollout is combined with instant merchant onboarding and POS provisioning performed remotely.

Rationalization

A single device can run seamlessly order management, inventory, payment acceptance and more, instead of separate systems awkwardly duct-taped together at the counter.

Handheld terminals and smartphones already on the field can be seamlessly upgraded to accept payments.

Easy integration

of value-added tools

Secure App-to-App communication and authentication make it straightforward to bolt on Electronic Cash Register (ECR), loyalty, tipping, or receipt tools.

Support for alternative

payment methods

Wallets, QR-based schemes, and account-to-account rails sit naturally alongside card acceptance in the same software stack and terminal.

No hardware certification bottleneck

There is no lengthy, expensive EMV/PCI hardware test-and-certification path to clear every time a device spec changes — which means far more freedom to adjust hardware specifications, innovate and customize POS (mechanics, screens, camera…).

A unified, scalable

back-end

One adaptable SoftPOS solution and cloud implementation serves many form factors.

No “brick risk”

Unlike a SmartPOS terminal that can be tamper-locked after a drop, a SoftPOS device generally is not rendered permanently unusable by physical shock.

3. SoftPOS at a turning point: why now is the time to take a closer look

SoftPOS has moved from the early bank-led pilots counted in tens of smartphones to street-level scale. Today, consumers can encounter COTS-based payment acceptance in their everyday lives – at farmers' markets, in taxis, with delivery riders, pop-up retail and more.

At the same time, a new generation of professional devices specifically designed for SoftPOS is emerging, enabling innovative Fintechs and payment providers to deploy more flexible and scalable acceptance solutions.

Several forces converged to get there.

• Contactless-only is now enough for most transactions: post-COVID pandemic consumer behavior has established contactless as the dominant experience in-store. Transaction speeds are significantly faster than chip-and-PIN (roughly 60% quicker), cards are near-universally contactless-ready, online PIN verification covers the cases that still require step-up authentication, and payment schemes continue to actively promote and expand NFC adoption.

• A maturing certification framework: after long awaited standards and clarifications, the earlier CPoC and SPoC standards have been consolidated into the single, modular, PCI MPoC framework. Schemes are phasing out their own proprietary programs, and EMV Contactless Level 1 RR certifications 1 & 2 ensure contactless performance on approved devices.

• A proven track record: beyond the now-established PCI security standard, years of SoftPOS activations and growing transaction volumes have validated both the security model and payment processing performance. The question is no longer whether SoftPOS can scale.

• Mainstream endorsement: Visa and Mastercard have been at the forefront of SoftPOS adoption, actively promoting the technology as a way to expand payment digitization and financial inclusion. Progressively, leading digital commerce, Fintech and software players — including Adyen, Square, SumUp, Revolut, Mollie, Shopify — have naturally extended their payments narrative into SoftPOS.

• Platform diversification: Apple's expansion of Tap to Pay on iPhone — initially launched in 2022 and accelerated by the broader NFC opening in 2024 — became a major catalyst for SoftPOS adoption. Besides, the increasing availability of SoftPOS applications on Windows and alternative operating systems such as KaiOS, is expanding the competitive field well beyond Android and to new form factors.

• Use-case diversity: in-person payment, peer-to-peer transfer, account top-up, digital commerce (Tap to add card, Tap to confirm transaction, Tap to activate on file) all now run on the same underlying SoftPOS technology.

• Paperless or no receipts: The growing shift away from mandatory printed invoices in many countries and consumers’ preference for digital alternatives strengthens the case for SoftPOS.

• Functional catch-up with EFTPOS: the complete payment cycle – authorization, refund, cancel, tipping - are now standard SoftPOS features while offline transaction handling is increasingly supported by SoftPOS solution providers.

• Compelling economics: SoftPOS on a personal phone or entry-level device comes at low-cost. Even for high-end setups, SoftPOS TCO (Total Cost of Ownership), including professional-grade devices, activation, recurring or per-transaction fees, now rival traditional EFTPOS.

• More purpose-built SoftPOS devices: hardware engineered from the ground up to run SoftPOS software, rather than repurposed consumer electronics — the focus of the next two sections.  

4. Myth vs. Reality: SoftPOS doesn’t eliminate dedicated hardware

The name is misleading. “SoftPOS” suggests that hardware doesn't matter, when the more accurate interpretation of the MPoC framework is the possibility of accepting payments on COTS devices. This is an indication about the applicable certification path, not a statement that no thought should go into the device.

4.1 A spectrum of implementations, not a binary choice

Real-world POS deployments are rarely a simple trade-off between SoftPOS and traditional EFTPOS. In practice, the two often coexist, serving complementary use cases within the same merchant environment.

Likewise, it’s not simply between SoftPOS on COTS vs. dedicated hardware. SoftPOS now spans a broad spectrum of setups: from personal phones with no accessory, used occasionally or to support financial-inclusion; to dedicated entry-level devices for developing markets; a variety of ruggedized mobile smart terminals running a secured Android operating system for small merchants, independent workers and food & beverage businesses; and to an expanding set of alternative OS options enabling new checkout experiences like stands, self-service kiosks, and other embedded payment acceptance solutions embraced by innovative hospitality and retail brands.

Large-scale SoftPOS rollouts are gaining momentum among leading fashion and restaurant chains, as well as postal and logistics organizations. These deployments require not only payment acceptance but also enterprise-grade capabilities such as remote provisioning, Mobile Device Management (MDM), application management, security updates, and lifecycle management, while optimizing costs.

4.2 Where personal devices fall short

When the underlying device is someone's personal phone, several limits show up quickly, and none of them are exotic:

• Battery life is shared with personal use — a low-battery warning mid-shift is not a payment terminal's finest moment.

• Ergonomics were never designed for payment: the NFC antenna sits wherever the manufacturer put it (often the back, not the front), screens crack, transaction processing is slow and performance degrades with age.

• Calls and notifications interrupt payments at the worst possible time.

The security picture is more serious. A personal smartphone runs arbitrary third-party Apps, may be rooted or jailbroken, carries an unpredictable OS patch level, and doubles as a browsing and sideloading device — all of which widen the attack surface that the SoftPOS application's runtime attestation has to detect and defend against.

This is precisely the rationale for a dedicated, professional-grade device: a secure, kept-current OS, a controlled patch cadence, dedicated security tooling, an App allowlist restricted to what the business actually needs and approved by the acquirer, and MDM across the fleet. The payoff is not just security — it is durability and robustness under daily commercial use, which a personal phone was never built for.

Framed the right way, this analysis is an opportunity rather than a cost center: moving the acceptance and compliance conversation onto “what experience and service quality does this give the merchants and their customers”.

The enterprise-grade rationale

COTS smartphones

SoftPOS specialized terminals

Apps for personal use (incl. calls, messaging)

Commercial value

Purpose-built professional device

No street value / no voice

Cardholder’s concerns over use of staff’s phones, poor Look & Feel

Dedicated hardware

Enterprise-grade design & robustness

Antenna opposite transaction display

Average NFC performance

Antenna on the front, at the top/underneath the display (PTS-like), combined with EMV Contactless Level 1 RR2 certification

Security challenges

No admin control

Terminal Management System (TMS)

Mobile Device Management (MDM)

Enterprise Mobility Management (EMM)

Android Enterprise

Android Zero-touch

Uneven RAM to power transactions &  

value-added Apps

Seamless and fast checkout

Smooth App to App flow

‍

‍

The range includes two main form factors: the Pocket and the Duo. Both devices support dual connectivity via 4G and Wi-Fi, ensuring reliable operation in different contexts.

The Pocket is a lightweight, handheld device designed for mobility. It enables staff to take payments directly to customers, improving service speed and reducing queues. Its compact design supports a fully paperless experience, helping merchants streamline operations and reduce costs.

The Duo, on the other hand, is suited for more traditional setups. Its printer-ready design allows businesses to provide physical receipts when needed, while maintaining the same level of performance and reliability. This makes it ideal for merchants who require a balance between modern efficiency and established practices.

By offering multiple form factors, Dojo and Mobiwire give merchants the flexibility to choose the solution that best fits their operational needs. Regardless of the device, the experience remains consistent, reliable, and optimized for performance.‍

Advancing Payments Through Innovation and Technology

The Dojo–Mobiwire partnership demonstrates the value of combining expertise in payment processing and device innovation. Together, they deliver customer-centric solutions that enable seamless payment experiences.

The recent device upgrade, including EMV L1 RR2 certification, highlights their shared commitment to continuous improvement. It ensures that merchants benefit from faster, more reliable contactless transactions, while maintaining flexibility across different use cases.

By combining SoftPOS capabilities with advanced hardware and strong processing performance, Dojo and Mobiwire provide a comprehensive and future-ready payment setup. With a continued focus on customer needs and innovation, they remain well positioned to shape the next generation of payment experiences for merchants and consumers alike.

About Dojo

Dojo is a leading payment technology provider that empowers over 140,000 businesses to grow their in-person commerce.

Dojo offers one of the world’s leading multi cloud-native payments platforms to provide in-person and digital payments solutions alongside value-added services such as business funding and booking management software.

Dojo’s highly reliable technology can be installed in a matter of minutes - giving businesses big and small the power to make informed decisions through instant insight and process, manage and measure card payments securely and easily.

‍