🏪 In-store payments

The terminal base and its manufacturers

The POS terminal (TPE in France) reads the payment instrument at the point of sale, handles the dialogue with the card, and sends the authorization request to the acquirer. It carries two certifications. Hardware security falls under PCI PTS, which covers the PIN pad and tamper resistance. Functional compliance falls under the scheme’s specifications, with CB approval in France (from Cartes Bancaires, France’s domestic card scheme) and EMV L1/L2 certification. France has more than 2 million acceptance points.

The big shift of the decade is the move from proprietary operating systems, Ingenico’s Telium and Verifone’s Verix, to secure Android SmartPOS devices. The terminal becomes an app platform. It hosts payment acceptance, tipping, loyalty, a lightweight register, and meal voucher handling. These apps are distributed through terminal app stores controlled by acquirers.

SoftPOS and Tap to Pay: the smartphone becomes the terminal

SoftPOS turns an ordinary smartphone or tablet into a contactless payment terminal with no additional hardware. A certified app reads cards and wallets through the device’s NFC. The security framework is the PCI MPoC standard (Mobile Payments on COTS, published in late 2022), which succeeds the SPoC and CPoC standards and covers PIN entry on the phone’s screen.

Apple Tap to Pay on iPhone has been available in France since 2023 through Adyen, SumUp, Revolut, myPOS, and Worldline. Together with its Android equivalents, it lowers the bar for setting up an acceptance point. A tradesperson can take payments on a phone after a few minutes of sign-up, without buying any hardware. On-screen PIN entry removes the €50 limit: above it, payments are accepted with a PIN or a mobile wallet (CDCVM).

Contactless: the de facto standard for in-person payments

Technically, contactless relies on ISO/IEC 14443 (the radio layer) and each scheme’s EMV contactless kernels, built into the terminal. The exchange is a full EMV transaction, including a dynamic cryptogram. The radio exchange takes ~300 to 500 ms.

PSD2 limits card contactless use through soft limits. Beyond a cumulative amount (€150) or a number of consecutive transactions (5) without authentication, the terminal requires the PIN. Mobile payments are exempt thanks to CDCVM: biometrics count as strong authentication on every transaction, with no limit. For larger purchases, mobile payments therefore go through without a PIN, which explains why they are gaining ground at the expense of the physical card.

Protocols and standards: from CB2A to nexo and CB6

French card acceptance rests on a well-defined stack of standards. EMV governs the card-to-terminal dialogue, and the CB5.5A specification governs the approval of CB terminals. CB2A handles terminal-to-acquirer messages, both online authorization and end-of-day batch upload, while Concert handles the register-to-terminal dialogue. This domestic legacy is migrating to CB6, the new generation aligned with the nexo standards, which are based on ISO 20022. The same messages then work across Europe, and proprietary national protocols disappear.

MTI  0100                      Message type: authorization request
DE2  4970 10xx xxxx 9012       Cardholder PAN (or token)
DE3  000000                    Processing code: purchase of goods/services
DE4  000000004250              Amount: EUR 42.50 (12 digits, in cents)
DE22 051                       Entry mode: 05 = chip (ICC) with PIN
                               (07x = contactless, 90x = magstripe)
DE41 TRM00042                  Terminal ID
DE42 3560001234500             Merchant contract number (SIRET-like)
DE55 9F26 08 A1B2C3D4E5F60708  EMV data, including the ARQC:
                               cryptogram computed by the chip,
                               verified by the issuer -> anti-cloning

--- Issuer response (0110) ---
DE39 00                        Response code: 00 = approved
                               (05 = generic decline, 51 = limit/funds,
                                55 = wrong PIN, 54 = expired card)
DE38 A1B2C3                    Authorization code to print on the receipt

Terminal certification has three levels. EMV Level 1 covers the physical and transport layers, for both contact and contactless, Level 2 the application kernel, and Level 3 end-to-end testing with the acquirer and the scheme. Every change in specifications, including the CB5.5A → CB6 migration, sets off waves of recertification across the installed base. Manufacturers, acquirers, and large retailers devote large-scale budgets to it, spread over several years.

Integrated payments: when the register drives the terminal

Integrated payments is the setup in which the register software (ECR/POS) sends the amount to the terminal and gets the result back, with no re-keying. Organized retail runs on this model, unlike the standalone terminal. In France, this dialogue has traditionally used the Concert protocol (V3.1/V3.2) over a serial or IP link, which is gradually being replaced by nexo Retailer.

• Zero re-keying: no more amount errors, and 5 to 10 seconds saved per payment.
• Reconciliation: every payment is tied to a register receipt, which is essential for reconciling the sales journal, the end-of-day batch upload, and acquirer payouts.
• Multi-lane: in large-format retail, a payment hub pools authorizations from dozens of checkout lanes, with multi-acquirer routing rules.

Card-present vs. card-not-present acquiring

Acquiring splits into two distinct regimes, contractually and technically. In-person payments, known as card-present, are transactions where the card and cardholder are physically present and the dialogue follows EMV. Remote payments, known as card-not-present, cover e-commerce and MOTO, meaning mail and telephone orders. Their risk profiles are radically different. An omnichannel merchant often signs two separate acceptance contracts, each with its own terms.

These orders of magnitude come from the annual reports of the OSMP (Observatoire de la sécurité des moyens de paiement), the Banque de France’s payment security observatory. French EMV card-present payments have consistently posted one of the lowest fraud rates in the world. Card-not-present payments, by contrast, account for most of the remaining fraud despite the widespread rollout of 3DS2.

Tips and cashback at the point of sale

The decline of cash has made card tipping a payments topic in its own right. Two approaches coexist. Adding the tip before authorization, with the server entering the total on the terminal’s selection screen, is standard in France. A post-authorization top-up adjusts the amount at capture, a common practice in the US but restricted by the schemes in Europe. SmartPOS and SoftPOS devices have made tip suggestion screens commonplace (5/10/15% or fixed amounts), with a measurable increase in tipping rates.

In 2022, France introduced an exemption from income tax and social contributions for tips paid by card to employees earning less than 1.6 times the SMIC (the French minimum wage). Successive finance acts have extended it since. The measure, designed to offset the disappearance of loose change, is therefore not permanent, and its renewal must be checked with each year’s finance act.

Cashback at the point of sale lets cardholders withdraw cash at the checkout when making a card purchase. The practice has been legal in France since PSD2 was transposed, and it is governed by a decree of December 2018:

• restricted to card payments for a genuine purchase of goods or services (no standalone cashback);
• minimum purchase of €1, with cash back capped at €60;
• optional for the merchant, who must display the terms; not allowed with anonymous payment instruments (non-personalized prepaid cards).