EMVCo TapToMobile is the industry term for accepting contactless card payments on a mobile device, such as a smartphone or tablet. In a TapToMobile setup, the device acts as the payment terminal, so merchants can take card taps without separate reader hardware. This is common in SoftPOS deployments and is designed for quick, low-cost acceptance at the point of sale.
It matters because moving payment acceptance onto general-purpose devices changes the security model. Defenders must manage device patching, app control, screen-lock policy, and malware risk, not just payment software. In real environments, TapToMobile is evaluated alongside standards such as PCI MPoC to reduce abuse like tampered devices, unauthorized apps, or unsafe configurations. For attackers, these environments can be attractive if the merchant uses weak device hygiene or poor access control. For defenders, TapToMobile is useful when convenience is matched with strong mobile security and operational discipline.