Point of interaction (POI) is the device where a cardholder and payment card first meet a merchant's systems: a countertop terminal, PIN pad, contactless reader, unattended reader in a vending machine, or a phone running a certified SoftPOS app. It reads the card through its EMV kernel, asks the chip for a transaction cryptogram, encrypts any PIN inside a tamper-resistant secure processor, and sends an encrypted authorization request to the acquirer, often using DUKPT keys. The POI handles only card and PIN data, while the point of sale covers the till software and wider checkout. Every PIN-accepting POI needs PCI PTS approval with an expiry date, so buyers of terminal businesses check estates for forced replacement costs.
What is point of interaction in payments
The term comes from EMV and PCI standards, which needed a name for the hardware that reads card data and captures the PIN, separate from the broader till or software. A POI can be attended, with a cashier present, or an unattended terminal at a fuel pump or parking machine. A phone running a certified SoftPOS app also acts as a POI for contactless cards.
How does a POI device work
When a card is dipped or tapped, the POI's EMV kernel selects the card application by its application identifier (AID), reads the card data and asks the chip to generate an application cryptogram for this transaction. If a PIN is required, it is entered on a tamper-resistant keypad and encrypted inside the device's secure processor.
The POI then builds an authorization request, encrypts sensitive fields with keys injected at a certified key-loading facility (commonly using DUKPT, which derives a unique key per transaction), and sends it to the acquirer or processor. It displays the response, prints or sends a receipt, and stores the transaction for the end-of-day batch.
Physical protections are built in. Opening the casing erases keys, and mesh layers over the circuit board detect drilling.
POI vs POS
The point of sale (POS) is the whole checkout setup: the till software, barcode scanner, cash drawer and inventory link. The POI is only the part that handles card and PIN data. In a supermarket, the POS calculates the €63.40 basket; the POI on the counter reads the card, takes the PIN and returns "approved" to the POS. In small shops a single all-in-one terminal plays both roles, which is why the terms get blurred.
PCI PTS approval and expiry
Every POI that accepts PINs must be approved under the PCI PIN Transaction Security (PTS) POI standard and listed by the PCI Security Standards Council. Each approval carries an expiry date, after which the model cannot be newly deployed, although units already in the field may keep running under brand rules. Devices used in point-to-point encryption (P2PE) solutions also need approved secure card-reading functions.
POI estates in acquisitions
For a buyer of an acquirer or terminal business, the POI fleet is a capital item. Checking model numbers against PTS expiry dates shows how much of the estate faces forced replacement, and at what cost per unit.
See also: Self-checkout.