Self-Service Kiosk Payments: Hardware and Compliance

What makes a payment unattended

A payment is unattended when the cardholder completes it at a device with no merchant employee present to check the card, answer questions or step in if something goes wrong. Order-ahead kiosks in quick-service restaurants, parking pay stations, vending machines, EV chargers, hotel and clinic check-in stations and retail self-checkout lanes all fall into this group. The card networks treat these transactions differently from staffed counter sales. The terminal identifies itself as cardholder-activated, the merchant category code has to match the business, and some rules on receipts, cardholder verification and disputes change. For a merchant, the practical point is that the processor, the terminal and the kiosk software company all have to set the device up as unattended from the start. Moving a countertop setup onto a kiosk stand does not do that.

Payment hardware: PCI PTS POI approval

The PCI Security Standards Council publishes the PIN Transaction Security Point of Interaction (PTS POI) standard. It covers devices that protect PINs and card data where the card is read. The Council used to run a separate program for unattended payment terminals. It now uses one set of modular requirements, with unattended payment terminals, PIN entry devices, secure card readers and encrypting PIN pads listed as device types. Approved devices appear on the Council's public Approved PTS Devices list, with an approval number and an expiry date. Before signing a kiosk contract, ask the vendor for the exact model and firmware of the payment module and look it up on that list. Kiosks are often built from parts, for example a touchscreen PC, an enclosure and a payment module from a different company. That means the approval belongs to the payment module, not the whole kiosk. Ask who installs the module, who seals it and who checks it for tampering.

PCI DSS scope on a kiosk

PCI DSS applies to any system that stores, processes or transmits card data, or that could affect the security of that data. The goal on a kiosk is to keep the kiosk computer out of that category. The usual approach is a payment module that encrypts card data inside the secure device and sends it straight to the processor, sometimes as part of a PCI-listed point-to-point encryption (P2PE) solution. The kiosk app then receives only a token or an approval result. If the kiosk software ever sees card numbers, the kiosk PC, its operating system and the network it sits on are all in scope, and your compliance work grows accordingly. Your acquirer decides which self-assessment questionnaire you complete. Get the integration design in writing before deployment, not after the first annual validation.

Card acceptance: contactless, chip and PIN

Most new kiosk payment modules accept EMV contactless cards and mobile wallets, and many also take chip insertion. Contactless keeps the transaction short and has no card slot to jam or tamper with. Chip insertion covers cards and customers that cannot tap. Magnetic stripe is still found on older vending and parking equipment, but it is the easiest entry method to skim. PIN entry matters when the kiosk needs to route debit on PIN networks or when the card asks for a PIN. That requires a PIN-capable device approved for that function, plus privacy shielding around the keypad. The network rules on cardholder verification at unattended terminals, including when no signature or PIN is needed, vary by network, merchant category and amount. Confirm current requirements with your acquirer rather than relying on a general threshold.

Receipts, refunds and disputes without staff

Visa's public rules and Visa Business News articles describe receipt requirements for unattended cardholder-activated terminals. Low-value unattended transactions may not need a printed receipt, and Visa has published a threshold above which the terminal must be able to provide a receipt when asked. Many kiosks now offer an email or text receipt instead of a printer. The receipt still has to show the merchant name as it appears on statements and a way to reach you. Unattended sales create familiar dispute patterns: product not dispensed, parking time not credited, duplicate charge after a timeout, or a customer who does not recognize the descriptor. Reduce these by showing a clear total and confirmation screen, logging each vend or order against its authorization, printing a support phone number or URL on the kiosk, and giving someone the authority to issue refunds remotely. A refund avoids a chargeback fee and a mark on your dispute ratio.

Pre-authorization and final amounts

Fuel pumps, EV chargers, parking exits and some self-checkout flows do not know the final amount when the card is presented. These kiosks typically authorize an estimated amount, then complete the transaction for the actual amount. The card networks have specific rules for how these estimated and incremental authorizations work, including limits by merchant category. The customer's bank may hold the authorized amount until the final one posts, which leads to complaints if the hold is much larger than the sale. Ask your processor which authorization types your merchant category supports and how quickly unused holds are released. Show the hold amount on the screen before the customer taps.

ADA accessibility: what is and is not settled

The Americans with Disabilities Act applies to businesses open to the public, and the Department of Justice's ADA regulations require them to communicate effectively with customers who have disabilities. As of September 2026 there is no final DOJ rule setting technical accessibility standards for self-service kiosks at private businesses. The U.S. Access Board issued an advance notice of proposed rulemaking on self-service transaction machines and kiosks in September 2022, and comments closed that November. The Board's guidelines would only become enforceable after an agency such as DOJ adopted them. In the meantime, the 2010 ADA Standards already cover ATMs and fare machines, and those provisions are often used as a reference for kiosk design. The lack of a kiosk-specific rule does not remove the general duty. Practical steps include reachable controls and card readers, tactile or audio options such as a headphone jack with speech output, sufficient contrast and text size, time-out warnings, and a staffed alternative that is easy to find. Get advice from ADA counsel for your specific setup.

Age-restricted items

Alcohol, tobacco, vaping products, cannabis where legal, some medications and lottery all require age checks under state or provincial law. A card payment does not prove age. Kiosks that sell these items usually either block them from self-service or pause the order until an employee checks ID, and some use approved ID-scanning hardware where the law allows it. Some jurisdictions prohibit unattended sales of certain products entirely, most commonly tobacco. Check the rules in each location before enabling the category, and make sure the kiosk logs who approved each override.

Offline mode and store-and-forward risk

Some unattended terminals can accept a card while the network is down, store the transaction and send it for authorization when the connection returns. This keeps a parking gate or vending line moving. The risk is that the merchant, not the bank, usually carries the loss if a stored transaction is later declined for insufficient funds, a closed account or a blocked card. Stored card data also has to stay encrypted on the device until it is sent. If you enable offline acceptance, set a low per-transaction limit and a cap on the number of stored transactions, alert someone when the device goes offline, and review declines after each outage. For kiosks with large tickets, it is often safer to stop taking payment and show a message instead.

Physical security and monitoring

An unattended terminal sits in public for long periods with nobody watching it, which makes it a target for skimming overlays, shimmers and swapped modules. Mount the payment module so it cannot be removed without tools. Record serial numbers and check them against inventory. Inspect the reader on a set schedule, and use the terminal management system to alert on tamper events, reboots and changes in firmware. PCI DSS requirement 9.5 covers protecting point-of-interaction devices from tampering and substitution, including periodic inspection and staff training. Assign that task to a named person at each site.

Requirements by kiosk type

The payment and compliance needs differ by kiosk type. Use this table as a checklist to work through with your processor, kiosk vendor and counsel before you buy.