One-Click Payment is a checkout method where a returning customer completes a purchase with a single action because card, billing and delivery details are already stored by the merchant, payment provider or a wallet. Amazon patented its 1-Click method in 1999 and licensed it to Apple; after the patent expired in September 2017, one-click became a standard gateway feature. The stored card is replaced by a token, increasingly a scheme network token that updates when the card is reissued, and each purchase runs as a normal card-not-present authorisation. In the EU and UK, strong customer authentication still applies unless an exemption such as the low-value rule fits. The main risk is account takeover, countered with device fingerprinting and step-up checks.
How does one-click payment work
On the first purchase, the customer enters card details and agrees to have them stored. The merchant or its gateway does not keep the raw card number; it replaces it with a token. Increasingly that is a network token issued by Visa or Mastercard, which the scheme updates automatically when the physical card expires or is reissued, so stored credentials keep working.
On later purchases, the checkout sends the stored token with the order. The customer sees one button; behind it, the gateway runs authorisation exactly as for any other card-not-present payment.
One-click payment and SCA
In the EU and UK, storing a card does not remove the requirement for strong customer authentication. A customer-initiated one-click purchase is still an electronic remote payment, so the issuer applies SCA unless an exemption fits. The most relevant are the low-value exemption under Article 16 of the RTS on SCA (Regulation 2018/389), which covers remote payments up to €30 as long as previous exempted payments since the last SCA total no more than €100 or number no more than five, and transaction risk analysis for low-fraud acquirers. The Article 14 exemption for recurring payments does not help here: it covers a series of payments of the same amount to the same payee, while one-click purchases are customer-initiated and vary in amount.
In practice, the gateway requests an exemption through 3-D Secure and the issuer decides. A customer buying a €12 e-book three times a week will be challenged after five exempted purchases if the issuer counts transactions, or after eight (€96) if it tracks the €100 total; a €180 order will usually go through a full authentication, often without a visible challenge if the device data matches.
What one-click does to conversion and risk
The commercial case is fewer abandoned checkouts: every field and redirect removed from mobile checkout loses fewer buyers. The risk is account takeover. A fraudster with a customer's login can spend on the stored card without knowing the card number, so one-click merchants rely on device fingerprinting, velocity limits and step-up authentication on new devices or changed delivery addresses.
For a buyer of a payment gateway or orchestration business, the stored-credential vault is part of the asset. Due diligence checks whether tokens are portable to another processor, whether network tokens are used, and what share of returning-customer volume runs without a challenge.