salmg/academy
Sign in
← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 3 · Operator60 min

SoftPOS and Tap to Phone

Commercial phones as contactless terminals: the PCI CPoC and MPoC standards, attestation, and what breaks when the terminal is an app on untrusted hardware.

Enrolment required

Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.

Sign inAbout enrolmentThe workbench and decoder are free

What this module covers

  1. 01What a certified terminal was actually providing
  2. 02CPoC, then MPoC
  3. 03Attestation, and what it can and cannot say
  4. 04The surface a SoftPOS deployment actually presents
  5. 05Why this direction is not reversing