How to accept card payments on your phone

Your phone becomes a card machine the moment a payment app is allowed to use its NFC aerial. This page covers the practical side — what you actually have to do to start accepting cards, what the phrase card reader app does and does not mean, and how a phone differs from the terminal you know. What each provider charges is on the costs page.

How to start accepting card payments on your phone

There is no engineer visit and no hardware to wait for. Four steps, and the slowest one is not yours.

1. Pick a provider and check your handset is on its list. Having NFC is not enough on its own — providers publish supported-device lists, and a phone that is rooted or has developer options switched on is usually refused. Our comparison of 108 providers shows which platforms each one supports.
2. Install the app and open a merchant account. This is the slow step. You are asked for your business details, proof of identity and, depending on the provider and how you are set up, company documents. Some providers approve a sole trader in minutes; others take a couple of working days.
3. Add the bank account the money should land in. Payouts go to a business account in the trading name in most cases. Check the payout schedule while you are there — next working day and three working days are both common, and the difference matters more to a small business than a tenth of a percent on the rate.
4. Take a small live sale before you rely on it. Charge yourself a pound and refund it. That tells you the handset works, the account is live and the money moves — three things that are easier to find out on a quiet afternoon than in front of a queue.

What you cannot do this way is take chip and PIN, because there is no slot. On the newest phones the customer can enter a PIN on your screen where the provider supports it; on older ones a card that insists on a PIN has to go somewhere else. That limit is the one thing worth knowing before you cancel a terminal contract.

On your phone or over the phone? Two different products

Two phrases look almost identical and mean opposite things. It is worth being sure which one you are shopping for, because the products, the prices and the risk are different.

On your phone means the customer is standing in front of you and taps their card or phone against yours. The card is present. This is tap to pay, the subject of this page, and it is the cheaper of the two because the card being physically there makes fraud harder.

Over the phone means the customer reads their card number out to you on a call and you key it into a virtual terminal in a browser. The card is not present. Card-not-present sales carry a higher rate at almost every provider, and if the payment turns out to be fraudulent the loss usually falls on you rather than the bank — that is the deal with keyed transactions. Providers sell this as a separate product; not every provider in our comparison offers it, and where it exists the price is rarely the headline rate.

If you take bookings or invoices by telephone, a payment link sent by text or email is worth a look before a virtual terminal. The customer types their own card details into the provider's page, which keeps the number away from you entirely and moves the liability with it.

What a card reader app actually is — and the two that are not

Search for card reader app and the results are a mess, because three unrelated things share the name. Only one of them takes money.

• A payment app that turns the phone into the reader. This is what this page is about: SumUp, Zettle, Square, Stripe and the rest, using the NFC aerial in your handset. Searched for as a contactless card reader app, a credit card reader app, a card reader app for iPhone or a card reader app for Android — same product, different words.
• A companion app for a separate reader. Older setups pair a small Bluetooth terminal with a phone; the app is only the till, the reader is still a piece of hardware you buy. If a provider's app requires a device in the box, it is this kind — worth checking before you assume no hardware.
• Two things that have nothing to do with taking payment. A business card reader app is almost always a scanner that photographs a paper business card and files the contact — the App Store and Play Store are full of them. And a Nationwide card reader app is about logging in to online banking: Nationwide issues members a small keypad reader to authorise payments and log-ins, which is a security device, not a way to accept money. Neither belongs in a merchant comparison, and we do not pretend otherwise.

If what you want is the first kind, the honest answer to which one is best is on our best tap to pay app page, and every provider we hold data on is in the full comparison.

What happens when the customer taps

You key the amount into the app and the phone switches on its NFC aerial — the same aerial you already use for Apple Pay or Google Pay, only working the other way round. The customer holds their card, phone or watch a couple of centimetres from the back of your handset.

The card does not hand over its number in plain text. It returns a package containing a dynamic cryptogram, worked out on the spot and valid for that one sale. Copy the package and it is worthless. If the customer pays with Apple Pay or Google Pay the real card number never appears at all: their phone sends a token, a stand-in number tied to that device.

Your app packs up what it received and sends it to your payment provider, which takes the authorisation to Visa or Mastercard and on to the customer's bank. Approved or declined usually comes back in two or three seconds.

Above the contactless limit, or when the customer's bank asks for it at random, a PIN pad appears on your screen. That keypad runs in a walled-off part of the phone: the rest of the app cannot see the layout or the digits. It is the part of the system the security standard scrutinises hardest.

So the division of labour is: your phone is the reader and the screen, the security sits in the card and on the provider's servers, and the card number is never stored on your handset.

Where this differs from the card machine you know

The obvious difference is that there is no box. Nothing to buy or rent, no separate charger, no till roll to reorder, no engineer visit. You download the app, get through the checks and start selling — often the same day.

The difference that only shows up later is how the card is read. A card machine takes three things: contactless, chip and PIN with the card inserted, and on older models the magnetic stripe. A phone takes contactless only. A customer whose card has no contactless symbol simply cannot pay you. That is rare in the UK now, but it still happens with some older business cards, a few prepaid and benefit cards and cards issued abroad.

Then come the awkward ones. The battery is the same battery you use for everything else. The receipt is digital unless you buy a printer. And it is your personal phone that gets handed towards strangers twenty times a day.

There is also the supported-handset question, which a dedicated card machine does not have: the box is approved at the factory, your phone has to earn its place on a list.

The table below puts the two side by side. Which providers offer which model in the UK is set out in the full comparison.

Security: what PCI MPoC actually certifies

PCI MPoC stands for Mobile Payments on COTS — payments on a commercial off-the-shelf phone. It is the security standard of the PCI Security Standards Council, the same body behind PCI DSS, and it is the standard that governs this kind of solution. Version 1.1 was published on 26 November 2024.

MPoC pulled together two things that used to be assessed separately: CPoC, which covered contactless reading, and SPoC, which covered typing a PIN on the screen. You will still see both acronyms in older provider material.

The standard does not just look at the app. It assesses the app, the back-end servers that watch every handset in real time, and the processes of the company that keeps all of it running. If a phone is rooted or jailbroken, has developer mode switched on, or starts behaving oddly, the system is expected to stop taking payments on its own. Validation is done by an accredited laboratory and approved solutions are listed publicly on the PCI SSC website.

Two honest caveats. First, the name on the listing is usually the technology supplier, not the brand you signed up with — your app can be covered without its own name appearing. Second, disclosure is patchy: of the 33 providers with a UK offer in our database, 10 publish a certification of this kind. Silence is not proof of anything either way, so ask in writing.

Which phones can actually do it

iPhone. The feature is called Tap to Pay on iPhone and Apple launched it in the UK on 13 July 2023, with Revolut and Tyl by NatWest first out of the gate. It needs an iPhone XS or later running the latest iOS. It accepts contactless Visa, Mastercard and American Express cards, Apple Pay and other wallets. Apple now lists roughly eighteen payment platforms for the UK, among them Adyen, Dojo, Global Payments, Mollie, myPOS, PayPal, Rapyd, Revolut, Square, Stripe, SumUp, Teya, Trust Payments, Tyl by NatWest and Viva.com. The constraint is rarely the handset — it is whether your provider has switched the feature on.

Android. You need NFC with HCE (Host Card Emulation) and a minimum OS version that differs from provider to provider; we have seen Android 8.0 demanded by one app and Android 10 by another. Rooted devices and phones with developer options enabled are normally refused outright.

On top of that sits the supported-device list. Many providers only enable the feature on models they have tested, because the position of the NFC aerial varies wildly between manufacturers. Grey imports, regional variants and obscure brands often miss out despite having NFC.

Before you sign anything — and certainly before you buy a phone for this — install the app, register and try a £1.00 sale. The app tells you straight away whether the handset qualifies. A phone with no NFC aerial will never work, and no update will change that.

What it costs, and what the price list leaves out

The pricing itself is taken apart on the costs page — transaction rates, monthly fees, payout timing, contract length and the charges nobody advertises. We are not going to repeat it here. What belongs on this page are the costs that appear on no price list at all, because nobody invoices you for them.

The first is the phone. It stops being a phone and becomes trading equipment: it gets dropped, rained on, nicked, or its screen goes on the busiest Saturday of the year. If it dies, your takings die with it — unlike a broken card machine, where the phone is still in your pocket to ring someone.

The second is mobile data. Every sale needs a connection and almost no app authorises offline. At a pitch with one bar of signal that is a takings problem, not a technology problem.

The third is battery, now shared between selling, taking bookings and everything else you do on that handset. A busy market day and a payment app running all afternoon do not go together without a power bank.

The fourth is the cost of moving. If your model drops off the supported list after an update, or a new provider demands a newer OS, you have an unplanned expense that was in nobody's advert.

The British particularity: the contactless limit is no longer fixed

In most markets a contactless limit is a number the card schemes set and everyone forgets about. In the UK it was written into financial regulation, and in 2026 it stopped being.

The old rule sat in Article 11 of the FCA's Technical Standards on Strong Customer Authentication. In PS21/2 the FCA raised the thresholds to £100.00 for a single contactless payment and £300.00 cumulatively before the customer has to authenticate — that is why a card sometimes asks for a PIN on a £4.00 coffee. It is not your app being awkward; the customer's bank has hit the running total.

On 19 March 2026 the FCA instrument FCA 2025/62 removed those fixed figures and replaced them with a risk-based exemption. Banks and card issuers with strong fraud controls may now set their own contactless limits, or none. The FCA was explicit that this is permissive, not compulsory: it is up to each firm whether and when to change anything.

What that means at your counter is unglamorous. You cannot set the limit and neither can your provider — the customer's bank does. Two customers at the same stall can now hit different ceilings, and the ceiling can change without warning. So do not promise a customer that £150.00 will go through contactless, and make sure the on-screen PIN entry works on your handset before you rely on it. On a phone that PIN pad is the only fallback you have: there is no slot to put the card in.

Where the technology runs out of road

Battery. A card machine that runs flat costs you a card machine. A phone that runs flat costs you the till, the calculator, the bookings diary and the phone. Carry a power bank; treat it as equipment, not an accessory.

Contactless only. There is no slot and no stripe. If a card will not tap, the sale does not happen. Keep a fallback — a payment link, a bank transfer, or yes, cash.

Receipts. The receipt is an email, an SMS or a QR code. Customers who want paper — trade customers claiming VAT, anyone doing an expenses claim — will ask, and you will need a plan that is not "write it down". More on what you are actually obliged to give them on our rules page.

Unattended and multi-till use. These apps are built for one person holding one phone. Self-service, a fixed kiosk or three staff on one account is not what they are designed for, and some providers forbid it in their terms.

Signal. Almost nothing authorises offline. Basements, church halls, steel-framed marquees and rural pitches are where this shows up, and it shows up as a queue.

The handset itself. Your personal phone now passes within a few centimetres of every customer, all day. Lock screens, notifications and photos are suddenly a business decision.

Mobile point of sale: the same job, an older name

Mobile point of sale, usually shortened to mPOS, is the trade's own name for the same idea: the till and the card reader travelling with the person serving, instead of sitting on a counter. The phrase is older than tap to pay and covers both shapes of it — a phone paired with a small Bluetooth reader, and a phone doing the reading itself.

The distinction matters when you are comparing mobile point of sale systems, because the phrase is also used for full till software — stock, staff, table plans, reporting — that happens to run on a tablet. That is a different purchase with a different budget. This portal compares the payment side: who reads the card, at what rate, on which handsets. If you need the stock control too, treat the payment rate as one line in a bigger decision rather than the decision itself.

For a small mobile business — a market stall, a mobile groomer, a tradesman taking payment at the door — the payment side on its own is usually the whole job, and the cheapest honest answer is a phone you already own plus an app. The costs page puts numbers on it.

Phone versus card machine, point by point

What	Phone (SoftPOS)	Card machine	What it means for you
Hardware	None — you already own it	Bought or rented, often on contract	No upfront outlay, but your phone becomes trading equipment
Card entry	Contactless only	Contactless, chip and PIN, sometimes stripe	A non-contactless card cannot pay you at all
PIN entry	On your own screen, in a walled-off keypad	On the machine's own keypad	Test it before you rely on it — it is your only fallback
Receipt	Email, SMS or QR code	Printed roll, plus digital on newer models	No paper unless you add a printer
Power and signal	Your phone's battery and data	Own battery, often own SIM or base	One flat phone stops trading altogether
Contract	Usually app-based, no minimum term	Frequently 12 to 48 months with exit fees	Check the term and the exit fee before you sign anything

Compare all 33 providers →

Common questions

How do I accept credit card payments on my phone?

Install a payment provider's app, open a merchant account with your business and identity details, add the bank account for payouts, and take a small live sale to check it works. On a recent iPhone or Android handset there is no extra hardware. Credit and debit cards are handled the same way at the till, though a few providers price them differently — the rate table on each provider page shows which.

Can I accept card payments over the phone the same way?

No. Reading a card number out over a call is a card-not-present sale, keyed into a virtual terminal rather than tapped. It is a separate product, it costs more at almost every provider, and the fraud liability generally sits with you rather than the bank. A payment link sent by text or email is usually the better answer for telephone orders.

What is the best card reader app for iPhone or Android?

It depends on your ticket size more than on the app. A low percentage with a fixed fee per sale is dear on small tickets; a flat percentage with no fixed fee is dear on large ones. Our best tap to pay app page names the cheapest published rate we can verify and says plainly where the answer changes.

Is mobile point of sale the same as tap to pay?

Mobile point of sale is the wider term and includes setups where a separate Bluetooth reader pairs with the phone. Tap to pay is the version where the phone itself reads the card, with no hardware at all. Every tap to pay setup is a mobile point of sale; not every mobile point of sale is tap to pay.

Do I need a special phone?

For iPhone you need an iPhone XS or later on the latest iOS. For Android you need NFC with HCE, a minimum OS version set by your provider, no root and developer options switched off. Many providers also keep a supported-device list, so a handset with NFC can still be refused. Install the app and try a £1.00 sale before you commit.

Can I take chip and PIN on a phone?

No. There is no slot. The phone reads contactless cards and wallets only. PIN entry does exist, but it happens on your screen after a contactless tap when the amount or the customer's bank demands authentication. If a card will not tap, you need another way to be paid.

Is it as secure as a card machine?

The card number is never stored on your handset, the card returns a one-time cryptogram, and wallet payments send a token rather than a real number. Solutions built to PCI MPoC are also monitored server-side and are expected to shut themselves down on a compromised phone. The weak point is usually the handset's own security, not the payment path.

What is PCI MPoC in one sentence?

It is the PCI Security Standards Council's standard for taking card payments on an ordinary phone, published in version 1.1 on 26 November 2024, replacing the older CPoC and SPoC standards. Approved solutions are listed publicly by the PCI SSC — though the listing usually names the technology supplier rather than the brand you signed up with.

Why did a customer's card ask for a PIN on a small sale?

Because their bank hit a running total, not because of anything you did. UK contactless used to be capped at £100.00 per payment and £300.00 cumulatively before authentication. Since 19 March 2026 issuers may set their own limits, so two customers can hit different ceilings at the same stall.

Is there a monthly fee?

Most UK apps in our database charge nothing monthly and take a percentage per sale instead; a few bundle the app into a paid business account. Fifteen of the 33 providers serving this market publish no price at all. The figures, the worked examples and the break-even point are all on the costs page.

What if my provider ties me into a contract?

App-based providers usually do not, but card machine deals frequently run 12 to 48 months with an early termination fee, and that is the classic UK trap. Read the minimum term, the notice period and the exit fee before signing. If it goes wrong, a business with with turnover under £6,500,000 can usually take a complaint to the Financial Ombudsman Service.