The five kinds of terminal
| Type | How it works | Suits |
|---|---|---|
| Countertop | Wired to the counter by Ethernet or Wi-Fi, often with a built-in printer | Retail counters, service desks |
| Portable or pay-at-table | Battery powered, Wi-Fi or cellular, carried to the customer | Restaurants, deliveries, markets |
| Customer-facing PIN pad | Tethered to a POS, the customer taps or inserts on their side of the counter | Multi-lane retail, POS setups |
| Smart terminal | An Android-based device that runs the POS app and takes cards in one unit | Small shops and cafes |
| Phone or tablet | A small reader paired by Bluetooth, or tap to pay on the phone itself with no reader | Low volume, mobile trades |
If you run a full POS system, the terminal has to be one your POS software supports, and that usually narrows the choice to one or two models. If you run a cash register, a standalone countertop terminal sits next to it and the cashier keys the amount twice.
EMV chip
EMV is the chip standard, named for Europay, Mastercard and Visa. Each chip transaction generates a one-time code, so data copied from one sale cannot be replayed to make a counterfeit card. The magnetic stripe carries the same data every time, so it was easy to clone.
In the US the card networks shifted liability for counterfeit card fraud in October 2015. Since then, if a counterfeit chip card is swiped at a terminal that could have read the chip, the merchant generally bears the loss instead of the card issuer. A terminal that only swipes is a fraud cost waiting to arrive.
NFC and contactless
Contactless payment uses near-field communication (NFC) over a range of a few centimeters. It covers tap-enabled cards and phone and watch wallets. Wallet payments replace the card number with a token, so the merchant never sees the real number. For the customer it is the fastest method; for the merchant it carries the same protection as chip.
Tap to pay on a phone turns a recent iPhone or Android handset into a terminal using an app from your processor, with no extra hardware. It suits low volume and mobile work. It does not print receipts or take chip-only cards, so check how often you would need a fallback.
PCI DSS in plain terms
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements written by the PCI Security Standards Council, founded by the major card networks. It is enforced through your merchant agreement, not by a government. What it asks of a small business comes down to a few things:
- Validate every year. Most small merchants complete a Self-Assessment Questionnaire (SAQ) through their processor. The questionnaire you get depends on how you take cards, and a simple standalone setup gets a short one.
- Do not store card data. Never write card numbers down, keep them in a spreadsheet or take them by email.
- Keep the terminal encrypted end to end. A terminal that uses point-to-point encryption (P2PE) encrypts the card inside the device, so card data never touches your network in readable form. That shrinks the scope of what you must secure.
- Inspect the devices. Check terminals periodically for tampering or skimming overlays, and keep a list of which device is where.
Processors commonly charge a monthly fee if you have not completed the questionnaire. Fill it in; it is usually quicker than arguing about the fee.
Buying, renting or leasing
You can buy a terminal outright, get one "free" with a processing contract, rent it month to month from the processor, or lease it from a finance company. Leasing is where small businesses lose the most money:
- Terminal leases are usually non-cancellable for the full term, often several years.
- The lease is often with a different company from the processor, so leaving the processor does not end it.
- Total lease payments can be several times the cost of buying the device.
- Some terminals are locked to the processor that supplied them and cannot be reprogrammed for another.
Fees and surcharges
Processing fees depend on the card type, how it was taken and your pricing model, and they change. The POS systems guide explains flat-rate, interchange-plus and tiered pricing. If you plan to add a card surcharge or offer a cash discount, card network rules require advance notice and clear disclosure to customers, surcharges generally may not be applied to debit cards, and some states restrict or ban them. Check your processor's rules and your state law before you start.
Specifications that matter
- Connectivity. Ethernet for a fixed counter, Wi-Fi for tableside, cellular for anything leaving the building. Ask about offline mode.
- Printer or not. A built-in printer saves counter space. Otherwise receipts go to a receipt printer or by text and email.
- Battery life for portables, and the number of spare batteries or docks you need for a double shift.
- Screen and tipping. Customer-facing screens with tip prompts matter in food service.
- Security certification. Terminals should carry current PCI PTS approval. Old devices lose approval and processors stop supporting them.
Before you buy
- Confirm the terminal works with your POS, and with more than one processor.
- Prefer buying outright; avoid non-cancellable leases.
- Choose a model with P2PE and current PCI PTS approval.
- Match connectivity to where you take payment: counter, table, curb or site.
- Get the processing fee schedule and termination terms in writing.
- Complete the PCI questionnaire once you are live.