PCI MPoC (Payment Card Industry Mobile Payments on COTS) is a security standard for turning a consumer smartphone or tablet into a card-acceptance device. It defines controls for software-based payment acceptance on ordinary, off-the-shelf hardware rather than on dedicated payment terminals.
This matters because mobile acceptance moves sensitive payment functions onto devices that also run email, messaging, and third-party apps. The standard focuses on reducing the risk of malware, tampering, weak device management, and insecure app integration. In real deployments, PCI MPoC helps vendors and merchants design SoftPOS systems with stronger isolation, secure authentication, encryption, attestation, and policy controls. Defenders use it as a benchmark for evaluating whether a mobile payment app is hardened enough for production use, while attackers may try to exploit rooted devices, outdated operating systems, or poorly protected merchant environments. MPoC is therefore a practical reference point for secure phone-based payments.