Click to Pay

What Is Click to Pay?

Click to Pay is a unified online checkout standard that lets consumers complete e-commerce purchases without manually entering card details. When a shopper reaches a checkout page displaying the Click to Pay icon, they identify themselves with an email address. The system recognizes their stored cards and presents them for one-click selection: no card numbers, no expiry dates, no CVVs.

The standard is built on EMVCo's Secure Remote Commerce (SRC) specification, first published in 2019. It replaced the card networks' earlier proprietary checkout wallets: Visa Checkout, Mastercard's Masterpass, and American Express Express Checkout. Rather than maintaining competing solutions, the networks agreed to unify under a single interoperable framework governed by EMVCo, the same body that manages the EMV chip standard used in physical card payments.

Click to Pay occupies a specific gap in the digital payments landscape. Apple Pay and Google Pay require their respective device ecosystems. PayPal requires a separate account. Click to Pay works for any cardholder on any device with a browser, making it the card networks' answer to platform-locked digital wallets. For merchants, it functions through their existing payment gateway or processor without additional fees beyond standard interchange.

How It Works

The SRC specification defines four core components that work together to deliver the checkout experience:

SRC Architecture

• SRC Initiator (SRCI): the merchant-side component, typically provided by the merchant's payment gateway or PSP. It loads on the checkout page and communicates with the card network backends to look up the consumer's profile and present available cards.
• SRC System: the card network backend operated by each participating network (Visa, Mastercard, AmEx, Discover). It stores tokenized cards, manages consumer profiles, and generates the network tokens and cryptograms used for each transaction.
• Digital Card Facilitator (DCF): the consumer-facing UI layer that handles the shopper's interaction: email entry, identity verification, and card selection. The DCF retrieves digital card representations from the SRC System and displays them to the consumer.
• SRC Profile: the consumer's unified profile across the SRC ecosystem. Cards from all supported networks linked to the same email address form a single profile, along with shipping addresses and device preferences.

Checkout Flow

For a first-time user, the enrollment process works as follows:

1. The consumer reaches a checkout page displaying the Click to Pay icon
2. They enter their email address; the SRCI queries each network's SRC System for a matching profile
3. No match is found, so the consumer is prompted to create a Click to Pay profile by entering their card details
4. The card network tokenizes the card and creates an SRC Profile
5. The consumer verifies their identity via a one-time password (OTP) sent to their email or phone
6. The transaction completes using a network token and dynamic cryptogram instead of raw card credentials
7. The consumer can opt to "remember this device" for future seamless checkout

For returning users on a recognized device, the experience is faster. A browser cookie and device fingerprint identify the consumer automatically. Their enrolled cards appear immediately without email entry or OTP verification. They select a card and complete payment in one click.

On a new device, the consumer enters their email, verifies via OTP, and then sees their stored cards. The SRC v1.5 specification (published October 2025) added passkey and FIDO-based authentication as an alternative to OTP, allowing consumers to verify with biometrics like fingerprint or face recognition.

Tokenization and Security

Every Click to Pay transaction uses network tokenization. The consumer's real 16-digit card number (PAN) is replaced by a unique token generated by the card network. This token is scoped to the specific merchant: it cannot be reused at another merchant, and if compromised, it is useless outside its intended context.

Each transaction also generates a dynamic cryptogram: a one-time cryptographic value unique to that specific transaction, token, and merchant. This prevents replay attacks where a captured transaction could be resubmitted.

The combination means merchants never receive or store actual card numbers, significantly reducing their PCI DSS compliance scope. If a merchant's database is breached, attackers obtain only merchant-scoped tokens with no value elsewhere.

Click to Pay also integrates with 3-D Secure (3DS 2.0) authentication. The SRC System can perform 3DS verification on behalf of the merchant, reducing friction while maintaining Strong Customer Authentication compliance for regions that require it, such as the European Economic Area under PSD2.

Adoption and Industry Push

As of early 2025, Click to Pay has over 70 million global registrations across 23 countries. While significant, this is modest compared to the billions of cards in circulation worldwide. The card networks are pushing adoption through mandates and infrastructure investment.

Visa has implemented a phased mandate requiring issuers to support Click to Pay: Europe from April 2024, the Middle East and Ukraine from April 2025, and South Africa from October 2026. All tokenization-eligible Visa cards must have Click to Pay as a pre-activated standard feature. Mastercard has announced plans to phase out manual card entry for e-commerce entirely by 2030, starting with Europe.

On the merchant side, major PSPs and payment gateways have integrated Click to Pay support: Adyen, Stripe, Cybersource, Worldpay, and ACI Worldwide all offer it. Merchants using these providers can enable Click to Pay through configuration rather than custom development.

Recent Developments

The SRC v1.5 specification added two notable capabilities. First, passkey authentication via FIDO standards eliminates the OTP step, bringing the checkout experience closer to Apple Pay's biometric simplicity. Visa has rolled out Payment Passkeys globally, and Mastercard has onboarded over 1,000 merchants for its passkey program. Second, the specification added support for EV charging payments via ISO 15118 Plug and Charge, extending Click to Pay beyond traditional e-commerce.

In 2026, Worldline, ING, and Visa completed a live AI agent-driven payment transaction in Germany using Click to Pay with passkey authentication, positioning the standard as a checkout layer for autonomous AI commerce.

Click to Pay vs. Digital Wallets

Click to Pay occupies a different position than Apple Pay, Google Pay, or PayPal, though they overlap at the checkout page:

In practice, most merchants offer Click to Pay alongside Big Tech wallets. Click to Pay fills the gap for consumers not in the Apple or Google ecosystem, desktop shoppers, and markets where digital wallets have lower penetration. It is designed to coexist with, rather than replace, existing wallet options.

Why It Matters

Click to Pay reflects a broader shift in payment rails: the card networks are investing in making online card payments feel as frictionless as contactless payments at a physical terminal. Manual card entry is the largest source of checkout abandonment in e-commerce, and every additional field a consumer fills reduces conversion.

For merchants, the value proposition is measurable. Visa reports that tokenized payments deliver a 6% improvement in approval rates for card-not-present transactions and a 30% reduction in fraud. Adyen reported a 4% authorization lift in its Click to Pay pilot. These improvements compound: higher approval rates, lower chargebacks, and reduced PCI compliance costs.

The trend toward tokenized, one-click checkout parallels what is happening in cryptocurrency payments. Solutions like stablecoins on Bitcoin layer-2 networks similarly aim to reduce payment friction: fewer steps, instant confirmation, and no manual credential entry. As traditional card infrastructure evolves toward tokenization and instant settlement, the gap between conventional and crypto-native payment rails narrows from both sides.

Risks and Considerations

Consumer Awareness Gap

Despite backing from every major card network, Click to Pay suffers from low brand recognition. Most online shoppers still do not recognize the Click to Pay icon or understand what it does. Apple Pay and Google Pay benefit from years of consumer education and device-level integration that Click to Pay cannot match through merchant checkout pages alone. The 70 million registrations, while growing, represent a fraction of the addressable market.

Inconsistent Checkout Experience

Because implementation varies across merchants and PSPs, the Click to Pay experience is not uniform. Some merchants embed it seamlessly; others present it awkwardly alongside other payment options. The OTP verification step on new devices adds friction that biometric-native solutions like Apple Pay avoid entirely. Cookie-based device recognition is fragile: clearing browser data, using incognito mode, or switching browsers resets the "remembered device" state, forcing the consumer back through OTP verification.

Merchant Integration Complexity

While PSP-based integration is straightforward for merchants already using supported gateways, legacy checkout systems and custom-built platforms face more difficult upgrades. Some major merchants have been slow to adopt. Smaller merchants may not prioritize integration when Apple Pay and Google Pay already cover most mobile shoppers.

Privacy and Data Handling

Click to Pay requires consumers to share their email address to create an SRC Profile, enabling cross-merchant recognition. Some consumers may be uncomfortable with this centralized identity layer, even though the actual card credentials are tokenized and never stored per merchant.

Recurring Payment Limitations

As of 2025, some PSP integrations (notably Adyen) do not support Click to Pay for recurring billing or subscription payments. This limits its applicability for subscription-based businesses, though the specification itself supports token lifecycle management that could enable this in future implementations.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.