The Checkout Has Two Customers

You are at the till. The card reader has already done its little theatre — the beep, the green light, the receipt that prints whether you asked for it or not. The shop, as far as the shop is concerned, is finished with you.

Then your phone buzzes. Approve this payment.

And there you are, standing in a queue at a Tesco Express in the drizzle, thumb hovering over a fingerprint sensor, watching a 90-second timer tick down while the person behind you mentally audits your life choices.

This is the modern UK checkout. Not a transaction, but a relay race between two institutions that have never met, with you as the baton.

The hop, the switch, the sigh

Let's trace the actual path of a card payment in 2026, because it explains a lot about why it feels the way it does.

You tap or insert. The terminal talks to the acquirer, the acquirer talks to the card scheme, the scheme talks to your bank. Your bank — or rather, the Access Control Server it has bolted onto the side of its stack — decides whether this purchase needs a little chat. If it does, you get pulled out of the merchant's app or browser, dumped into your banking app, asked to prove you are you, and then, if the wind is blowing the right way, returned to roughly where you started.

Sometimes the return lands. Sometimes it doesn't. Sometimes you approve on the phone, the app says done, and the merchant's page sits there like a fridge that has forgotten what it was doing. You refresh. You get a basket that's now empty or, worse, a duplicate order. You try again. The second attempt sails through without a prompt, which tells you the first one probably wasn't actually a failure — it was just a conversation nobody bothered to finish.

The technical name for this is Strong Customer Authentication. The street name is the hokey cokey.

Two organisations, one interface

Here's the thing worth holding onto: the prompt you see was not designed by the shop, and it was not designed by your bank in isolation. It is the visible seam where two very different businesses meet.

The merchant's incentive is conversion. Every extra step costs them money, and a checkout that requires a second device is a checkout with a hole in it. The bank's incentive is fraud liability. Under the current rules, if it can show it applied SCA, the liability for certain frauds shifts away from it. The prompt, in other words, is not purely a security control. It is a receipt. It is the bank saying we asked, and they said yes.

Neither party is being villainous. Both are optimising for the thing their board asks about. But the interface that results from that negotiation is not optimised for the person standing in the drizzle. It is optimised for a liability argument between two firms who will never queue behind each other at a self-service till.

This is why the flow feels oddly formal. The language is legal. Authenticating... Verifying your identity... Your bank needs to confirm this payment. Nobody is lying to you, exactly, but nobody is talking to you either. It reads like a form letter because it is one.

What the fallback tells you

Pay attention to the fallback. When the app prompt fails, you get a text message with a six-digit code, and you have roughly the length of a kettle boil to type it in before it expires.

SMS one-time passcodes are the checkout equivalent of a spare key under the flowerpot. They exist because the primary mechanism can't be trusted to work every time, and they are tolerated because the alternative is worse — an outright decline. But their continued presence tells you something uncomfortable about the design. If the primary path were genuinely robust, the fallback wouldn't need to be quite so load-bearing.

And then there is the silent decline. The one with no prompt at all. You tap, the terminal says no, the cashier says try again, and your bank app shows absolutely nothing — no pending transaction, no reason, no hint. Somewhere in the stack a risk engine made a judgement about you and declined to share it. You are left to reconstruct the event from vibes.

A calmer checkout is possible, and it's mostly plumbing

None of this is unsolvable. It is a design problem, and the UK has the ingredients to fix it.

Start with context. When a bank asks you to approve a payment, it should tell you what you're approving — merchant, amount, and, crucially, a line explaining why this one needed a check. "New merchant", "unusual amount", "first payment to this shop". A prompt that explains itself spends far less of your patience.

Next, hand back the basket. The merchant should treat the redirect as a temporary detour, not a reset. If you come back and the cart is gone, the shop has effectively punished you for a security step it also insisted on.

Then there's the return path. Banks and merchants both have deep-link tooling now. There is no good reason for "I approved it in the app but the website doesn't know" to still be a thing in 2026. If the app can hand control back to the browser, it should. If it can't, the merchant should poll for the outcome quietly rather than making you refresh and gamble.

And declines should have reasons. Not full risk-engine confessions — nobody wants that — but a short, standardised explanation in the app and on the receipt. Blocked: unusual location. Blocked: repeated attempts. Something a human can act on, rather than a shrug with a transaction ID.

Finally, the bank could stop treating the checkout as a place to upsell. The half-second where you're waiting for the prompt is not the moment for a carousel of product offers. It's the moment you notice how long the timer is.

The trust budget

Every checkout is a small trust exercise. You trust the shop to charge the right amount, the bank to notice fraud, and the plumbing to work at the moment you're holding up a queue. Each extra hop spends a bit of that budget. Most of us have plenty left, which is why the current mess limps along. But it is not infinite, and it is not being replenished.

The two organisations in the middle of this have spent years negotiating with each other. It's probably time they spent a few minutes negotiating with the third party in the room — the one with the thumb on the sensor and the drizzle on their coat.