What is Checkout?
The merchant-facing payment surface, the form, hosted page, or SDK where the customer enters payment details.
The Checkout is the customer-facing interface where payment details are entered and a transaction is initiated. The design and technical implementation of the Checkout page are critical for conversion, security, and regulatory compliance.
Merchants can choose from several integration methods, each with different implications for their PCI DSS scope. A fully hosted payment page redirects the customer to a secure page managed by the payment provider, minimising the merchant's PCI burden.
An embedded iframe allows the payment form to appear seamlessly within the merchant's site while still isolating the sensitive data from their servers.
A direct API integration offers maximum control over the user experience but brings the merchant's entire environment into PCI DSS scope, requiring significant compliance overhead.
Modern checkouts must be engineered to handle regulatory requirements such as Strong Customer Authentication (SCA) under PSD2 in Europe.
This involves integrating a 3D Secure service that can manage the authentication flow, determining whether a transaction can be approved via a Frictionless flow or requires a Challenge flow (e. g. , a one-time passcode or biometric approval).
Checkout optimisation also involves dynamically displaying relevant Alternative Payment Methods (APMs) and digital wallets like Apple Pay or Google Pay based on the customer's device and location.
The data collected at Checkout, such as card details, billing address, and CVV, is sent in an authorisation request to the payment gateway, which then routes it to the appropriate acquirer and card scheme.
Worked example
A UK fashion retailer uses an iframe-based Checkout provided by Cardflo. A customer in France adds a €250 jacket to their cart and proceeds to pay.
The Checkout page, embedded on the retailer's domain, detects the user's location and device, displaying options for Cartes Bancaires, SEPA, and Apple Pay alongside the standard card entry form. The customer chooses to pay with their Visa card.
They enter their card number, expiry date, and CVV. Because the transaction is over the €30 Low-value exemption and is a Cross-border transaction within the EEA, SCA is mandatory.
Upon submission, the 3D Secure process is initiated. The Electronic Commerce Indicator (ECI) value of 05 (fully authenticated) is targeted.
The issuer's ACS presents a challenge, requiring the customer to approve the €250 payment in their mobile banking app. Once approved, the authorisation request is sent, approved, and the liability for fraudulent chargebacks shifts to the issuer.
The entire process, from form submission to confirmation, takes less than 15 seconds.
Scheme notes
Visa and Mastercard rules heavily influence Checkout functionality, primarily through 3D Secure. Both schemes have updated protocols (Visa Secure and Mastercard Identity Check) that support the 3DS2 standard, enabling richer data exchange between the merchant and issuer to facilitate frictionless authentication.
The schemes mandate the correct use of the Electronic Commerce Indicator (ECI) flag in the authorisation message; a 05 for a fully authenticated 3DS transaction in Europe, or 07 for a non-3DS authenticated transaction.
Incorrectly flagging transactions can lead to higher interchange fees, lower approval rates, and a loss of liability shift protection in cases of fraud.
Why it matters for merchants
The Checkout is arguably the single most critical factor for a merchant's sales conversion. A poorly designed Checkout with unnecessary fields, a jarring redirect, or a lack of relevant payment methods directly leads to abandoned carts and lost revenue.
For SCA-mandated regions like the EEA, a failed or clunky 3D Secure integration can decimate approval rates. Partnering with a provider like Cardflo, whose orchestration platform and smart routing can dynamically optimise Checkout flows, enables merchants to maximise approvals.
For example, routing a transaction to a local acquirer or intelligently retrying a Soft decline can recover revenue that would otherwise be lost at the Checkout stage.
Frequently asked
How does the choice of Checkout impact PCI DSS compliance scope?
Using a hosted payment page or a modern iframe-based Checkout generally qualifies a merchant for SAQ A, the simplest compliance level, because card data never touches the merchant's server.
If a merchant uses a custom API Checkout to collect data directly on their own infrastructure, they typically fall under SAQ D, requiring a significantly more rigorous and expensive annual audit.
What role does the Checkout play in SCA and 3D Secure 2 flows?
The Checkout acts as the orchestration layer that triggers the 3DS request to the issuer when a transaction requires authentication.
It must be capable of handling redirects or displaying the issuer's authentication challenge window within the UI without breaking the customer session or causing transaction timeouts.
What is the difference between a hosted payment page and an iframe Checkout?
A hosted payment page (HPP) redirects the customer away from your website to a page fully hosted and controlled by your payment provider. This greatly simplifies your PCI DSS compliance to a simple SAQ A.
An iframe Checkout embeds the payment form within a window on your own Checkout page, creating a more seamless customer experience while still ensuring sensitive card data never touches your servers.
This typically requires SAQ A-EP, which is slightly more involved but still far less onerous than a direct API integration.
How can I improve my Checkout conversion rate?
To improve conversion, minimise the number of form fields, ensure the page is mobile-responsive, and display trust signals like security logos. Offer popular digital wallets like Apple Pay and Google Pay, which can increase conversion by over 20% in some demographics.
For international customers, display prices in their local currency and offer familiar local payment methods. Using an Address Verification Service (AVS) can also speed up form filling.
Does my Checkout need to support 3D Secure?
If you sell to customers in the European Economic Area (EEA) or the UK, supporting 3D Secure 2 (3DS2) is mandatory for most transactions due to Strong Customer Authentication (SCA) regulations.
Even outside these regions, using 3DS is highly recommended as it provides liability shift protection against certain types of fraudulent chargebacks.
For example, a merchant who successfully completes a 3DS transaction is typically not liable for a chargeback with reason code 10.4 (Fraud - Card-Absent Environment).
What data should I be collecting at Checkout to optimise authorisations?
Beyond the basic PAN, expiry, and CVV, collecting a full billing address is critical for AVS checks. For 3DS2, providing rich data is key.
This includes customer details (name, email, phone), shipping information, and device data. Passing at least 15 data points can significantly increase the chances of a Frictionless flow, where the issuer approves the transaction without challenging the cardholder, boosting conversion rates by avoiding friction.
How do digital wallets like Apple Pay and Google Pay work with my Checkout?
Digital wallets replace the need for manual card entry. When a customer chooses Apple Pay or Google Pay, the wallet uses biometric authentication (Face ID, Touch ID, or fingerprint) on the device to verify the user.
It then passes a device-specific token (DPAN) to the payment gateway, not the underlying card number. This is highly secure, qualifies for SCA, and provides a very fast, low-friction experience, as shipping and billing details are often auto-filled from the wallet.
See how Checkout plays out in practice
Industries and regions where this term drives real acquiring, routing, or dispute decisions.
Related terms
Any non-card payment method, wallets, bank transfers, BNPL, vouchers, accepted at checkout.
The Payment Card Industry Data Security Standard, the scheme-mandated framework for handling cardholder data.
A card-network authentication protocol that shifts fraud liability from the merchant to the issuer when a cardholder is verified.
PSD2 requirement that customer-initiated electronic payments in the EEA and UK be authenticated with two of: knowledge, possession, inherence.
Related guides.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.