Free tools Windows power users keep installed
One-click scans. No signup required.
The lowest transaction rate is rarely the lowest-cost government payment solution. A defensible procurement compares five-year total cost, PCI DSS responsibility, fraud and dispute exposure, accessibility, payment channels, reporting, reliability, data governance, portability, and whether the contract can satisfy public-sector authorization and purchasing rules.
That broader view matters at federal scale. The U.S. Department of the Treasury reported in a February 4, 2025 letter that the Bureau of the Fiscal Service handles nearly 90% of federal payments and more than 1.2 billion transactions each year. A processor decision therefore affects public access, reconciliation, fraud losses, auditability, and continuity—not just the fee on a card transaction.
As an Amazon Associate I earn from qualifying purchases.
Start with a complete cost-of-ownership model
Ask each bidder for a fee schedule that covers the entire service, then model the cost over at least five years. A per-transaction quote can conceal fixed charges, implementation work, support tiers, compliance expenses, and an expensive exit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Costs to include in the RFP workbook
- Card-brand and payment-method pricing, including ACH, credit, and debit transactions.
- Gateway, platform, account, minimum-volume, and statement fees.
- Refund, chargeback, retrieval, and representment fees.
- Hardware, terminal certification, shipping, replacement, and device-management costs.
- Implementation, integration, testing, migration, and staff-training charges.
- Premium support, after-hours incident response, and service-management fees.
- PCI assessments, vulnerability scans, penetration testing, and other compliance services that are not included in the base price.
- Custom reporting, data exports, API access, storage, and records-retention charges.
- Termination, transition assistance, token migration, and data-export costs.
Separate recurring charges from one-time charges and identify which prices are promotional, volume-dependent, or subject to annual increases. GOV.UK Pay, for example, describes no license fee and no minimum transaction volume while separating transaction fees from support, upgrades, compliance, branding, and accessibility costs. That is a useful structure for an RFP, not a reason to assume another provider uses the same model.
#1 Best Overall
- With Square Terminal, you can ring up sales, accept payments, and print receipts, all with one device. Use it at the counter or ring up customers anywhere in your store.
- Accept all major credit and debit cards and pay one low rate with no hidden fees and no long-term contracts.
- Process chip cards in just two seconds.
- Get your money as soon as the next business day.
- Use it cordlessly with the built-in battery, designed to last all day.
Compare scenarios, not one average transaction
Build at least three workload cases: normal operations, a seasonal or filing-period peak, and an incident or migration year. Include the mix of ACH, credit, debit, refunds, failed payments, disputes, and assisted transactions. A processor with a slightly higher card rate may have a lower five-year cost if it reduces manual reconciliation, includes required reporting, or avoids new hardware and compliance work.
Make PCI DSS responsibility explicit
Treasury states that an agency processing, storing, or transmitting card data must fully comply with the Payment Card Industry Data Security Standard (PCI DSS). Do not accept a general “PCI compliant” statement. Map every control to the agency, processor, hosted-payment component, and any subcontractor.
Evidence to request
- A current Attestation of Compliance for the exact service and service-provider level.
- The applicable PCI DSS version, scope description, responsibility matrix, and network diagrams.
- Details of hosted fields, redirects, tokenization, encryption, key management, and administrative access.
- Incident-notification deadlines, forensic cooperation, evidence preservation, and cost-allocation terms.
- Audit rights, remediation timelines, and notice requirements when the provider changes a material control.
Treasury’s CAS security posture includes PCI DSS, EMV, encryption, and tokenization. Tokenization or a hosted collection page can reduce the systems in the agency’s cardholder-data environment, but it does not automatically remove the agency’s obligations. The agency still has to validate its own configuration, web pages, integrations, access controls, and procedures.
Protect prohibited card data
Treasury says agencies must not retain full magnetic-stripe data, CVV or CVC values, or PIN blocks after authorization. Confirm that logs, support tools, exports, backups, analytics, and test environments cannot capture those values. Require masking rules and a documented deletion process rather than relying on a sales statement.
Match validation to the agency’s merchant level
Treasury describes annual PCI self-assessment and, for agencies with external-facing IP addresses in the cardholder-data environment, quarterly vulnerability scans by an Approved Scanning Vendor. Put the evidence-delivery schedule and cooperation with the agency’s assessor or scanning vendor in the contract. The processor’s certification does not replace the agency’s required validation.
Separate FedRAMP evidence from the agency’s authorization
For a hosted service, request the exact FedRAMP service offering, authorization package, control inheritance documentation, provider-operated controls, data locations, subprocessors, encryption practices, retention and deletion rules, and government-access provisions.
Rank #2
FedRAMP authorizes a cloud offering; the agency’s authorizing official accepts risk for the agency’s actual information system. That system includes its configuration, identity integration, interfaces, business processes, and data flows. A vendor’s FedRAMP authorization or claim is therefore evidence to evaluate, not a substitute for the agency’s security assessment and authorization decision.
Questions for the security and privacy review
- Which exact service boundary and authorization package cover the payment functions being procured?
- Which controls are inherited, which are operated by the provider, and which remain with the agency?
- Where are transaction, payer, support, and backup data stored and processed?
- Which subprocessors can access the data, and how will the agency be notified of changes?
- How are encryption keys managed, rotated, escrowed, and destroyed?
- What happens to records, tokens, logs, and backups at contract expiration?
Map methods, channels, and transaction limits
Write the public journeys before selecting a processor. A web payment for a permit, a recurring installment, a phone-assisted payment, and a kiosk transaction can require different interfaces, controls, receipts, and settlement rules.
Payment methods and collection paths
- ACH, credit card, and debit card.
- Hosted checkout, embedded fields, and API-based collection.
- Desktop, phone-assisted, mobile, and kiosk acceptance.
- Recurring or installment patterns where the program legally permits them.
- Partial and full refunds, voids, reversals, and adjustments.
- Language, assisted-digital, and alternative channels for people who cannot complete an online form.
Pay.gov describes ACH, credit-card, and debit-card collections, modular forms and billing, and reporting integrations. Treasury CAS onboarding supports traditional stand-alone terminals, value-added resellers, integrated software vendors, and mobile applications and devices. These descriptions show why “supports cards” is not a sufficient requirement: the agency must specify the channel, integration mode, and operational workflow.
Check hard eligibility gates early
Treasury CAS sets a maximum single credit-card transaction of $24,999.99. Treasury also says CAS is not the right processor for credit-card payments on debts or for credit or debit payments above that amount. Agencies handling high-value, unusual debt, international, or non-card programs should identify those cases in the market research and obtain a written eligibility determination before scoring price.
Specify currencies and program rules
List required currencies, geographic restrictions, payer identity checks, convenience-fee rules, refund deadlines, and any statutory limits in the solicitation. A processor can be technically capable yet unsuitable for a program whose authorizing law or treasury policy imposes different rules.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Evaluate reconciliation and reporting as core functions
Payment acceptance is only complete when finance staff can prove what was authorized, settled, refunded, reversed, and deposited. Score the operational workflow, not just the checkout screen.
Rank #3
- Includes Elavon encryption
- Chip Card / EMV / NFC Compatible
- 2.4’’ Color LCD with backlight
- 192 MB of Memory (128 MB RAM / 64 MB DDR RAM)
- Includes terminal and power supply
Capabilities to demonstrate
- Real-time authorization, failure, settlement, refund, and reversal status.
- Exports and APIs with stable identifiers that connect a payment to the agency’s case, bill, or account.
- Daily settlement files, deposit matching, exception queues, and configurable accounting dimensions.
- Role-based access, approval workflows, immutable audit logs, and administrator activity reports.
- Retention controls and search that let authorized staff answer payer questions without exposing sensitive data.
- Sample reports for volume, fees, disputes, refunds, failed payments, and outstanding reconciliation items.
Pay.gov highlights transaction reporting and real-time payment and refund information. During evaluation, require a live API walkthrough and sample files using the agency’s identifiers. Ask bidders to show how an accounting user finds a payment that was authorized but not settled, a refund that has not reached the payer, and a chargeback that must be posted to the ledger.
Price fraud, disputes, and liability—not just controls
Fraud tools are useful only when the contract explains who operates them and who bears the financial and operational consequences. Ask who sets rules, monitors alerts, approves manual review, responds to account takeover, and absorbs an unauthorized-transaction loss.
Fraud controls to compare
- Velocity limits by card, account, device, IP address, and payer identity.
- Device and IP reputation signals, geolocation checks, and bot controls.
- Policies for prepaid cards, anonymous payments, and transactions without an IP address.
- Manual-review queues with service-level targets and an override audit trail.
- Refund-abuse detection and controls against repeated reversals or duplicate submissions.
- Credential-reset and account-takeover response, including notification and containment.
GOV.UK Pay notes that anti-fraud measures are generally set by the payment service provider and gives examples such as blocking prepaid cards or rejecting transactions without an IP address for higher-risk services. Treat those as configurable policy choices: a restriction that protects one program may block legitimate access in another.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMake dispute handling operational
Require a chargeback workflow that supplies reason codes, deadlines, evidence requirements, status changes, and ledger treatment. Pay.gov agency documentation includes a fraud-management guide and testing guidance; ask for equivalent documentation and a sandbox exercise. Contractual language should state whether the processor or agency prepares representment evidence, how losses are allocated, and the response time for urgent fraud events.
Score accessibility and public trust
Accessibility is a payment requirement, not a design extra. Require keyboard-only completion, screen-reader labels and focus order, accessible error messages, readable receipts, responsive mobile layouts, sufficient contrast, and an equivalent phone or assisted-digital path where online completion is not practical.
Ask for a current accessibility conformance statement, test methodology, known issues, remediation dates, and evidence from independent testing. GOV.UK Pay reports WCAG 2.2 compliance with no known failures, which is a useful public-sector benchmark. Verify the exact service version and journey being purchased rather than treating a product-level claim as proof of conformance for the agency’s customized pages.
Rank #4
- Expert POS Deployment Support - Unlike standard online purchases, SwyftPAY provides hands-on onboarding assistance from payment industry professionals with over 50 years of experience serving retail, restaurant, mobile, and service-based businesses.
- Designed for Growing Businesses - Ideal for retail stores, restaurants, food trucks, service contractors, salons, medical offices, professional services firms, and other businesses seeking a modern payment acceptance solution.
- Portable point-of-sale device designed for accepting card and digital payments on the go. Supports multiple payment methods including chip (EMV), tap-to-pay (NFC), and mobile wallets (e.g., Apple Pay, Google Pay)
- Equipment ships after signup with Square, through SwyftPAY.
Test the whole journey
- Start with a keyboard-only user who must create or locate a bill.
- Submit an invalid card, an invalid ACH account, and a declined payment; verify that errors identify the fix without losing entered information.
- Complete a payment on a small mobile screen and inspect the receipt, refund instructions, and support contact.
- Repeat with a screen reader and confirm that status changes, timeout warnings, and confirmation numbers are announced.
- Test the phone or staff-assisted alternative, including identity verification and privacy controls.
Compare reliability, support, and change management
Include uptime objectives, maintenance windows, recovery time and recovery point objectives, support hours, escalation levels, incident-notification deadlines, and service credits in the scorecard. Ask for historical incident summaries and a clear distinction between a payment-provider outage, a network outage, and an agency integration failure.
Require a safe release process
- A versioned sandbox that mirrors production behavior for payment, refund, dispute, and accessibility tests.
- Advance release notices, change descriptions, and a period for agency validation.
- Rollback or mitigation procedures when a change interrupts collection.
- Named technical and executive escalation contacts.
- Communication templates for agency staff and the public during an incident.
Pay.gov publishes release notices and testing guidance. Ask every bidder for equivalent evidence and require the agency to approve a test plan before production changes affect a regulated or high-volume payment journey.
Protect portability and procurement fit
A payment service is difficult to replace if the agency cannot take its records, customer references, or tokens with it. Require exportable transaction and payer records in documented, usable formats; stable APIs; data dictionaries; retention and deletion controls; and transition assistance.
Contract terms that prevent lock-in
- Agency ownership and permitted uses of transaction, payer, and operational data.
- Documented export formats, schedules, completeness checks, and test exports.
- Token portability or a re-tokenization plan that avoids forcing every payer to re-enter a payment method.
- Subprocessor disclosure and prior notice of material changes.
- Audit, records-retention, public-records, accessibility, and data-protection obligations.
- Termination rights, reasonable transition pricing, cooperation with a successor, and verified deletion after the retention period.
Procurement counsel should confirm that the proposed terms fit the agency’s purchasing vehicle and statutory requirements. A technically strong processor can still fail if its indemnity, data-use, audit, accessibility, or public-records language cannot be adopted.
Build a weighted evaluation scorecard
Use written requirements and demonstrations so a low quote cannot outweigh a material compliance or continuity weakness. A practical scorecard has six axes:
| Axis | What to score |
|---|---|
| Risk and compliance | PCI DSS scope and Attestation of Compliance, encryption and tokenization, incident response, FedRAMP evidence, audit rights, and control ownership. |
| Public experience | Accessibility, mobile performance, language support, assisted-digital options, receipt clarity, and refund communication. |
| Operations | Settlement, reconciliation, reporting, APIs, refunds, support, uptime, incident handling, and release management. |
| Coverage | ACH and card support, web/API/phone/mobile/kiosk channels, transaction limits, currencies, and special program needs. |
| Economics | Complete five-year cost, implementation and migration, chargeback exposure, hardware, compliance work, and exit costs. |
| Control and portability | Data ownership, retention and deletion, subcontractors, export, token migration, termination assistance, and procurement terms. |
Use demonstrations and evidence gates
Make certain requirements pass/fail before applying weighted price and feature scores. Examples include an acceptable PCI responsibility model, required payment methods, the CAS transaction-limit decision, accessible completion of critical journeys, usable exports, and contract language that permits audit and records retention. Then require each finalist to demonstrate authorization, refund, reconciliation, dispute, outage, and accessibility scenarios using the agency’s test cases.
Plan for physical acceptance only when it is justified
An EMV payment terminal can be appropriate for a stand-alone counter, kiosk, or field operation. Treasury CAS explicitly lists traditional stand-alone terminals as a supported channel. Select hardware only after confirming processor compatibility, network connectivity, EMV certification, device management, accessibility, replacement logistics, and procurement eligibility. A terminal purchase does not solve PCI scope, reconciliation, or accessibility requirements by itself.
Common procurement mistakes
- Choosing the headline rate: Correct it with a five-year model that includes refunds, disputes, implementation, support, compliance, and exit.
- Accepting a logo or certificate as proof: Require evidence for the exact service, version, region, and configuration.
- Assuming hosted checkout eliminates PCI work: Confirm residual controls, scripts, redirects, access, and annual validation.
- Testing only a successful card payment: Add declines, refunds, ACH failures, disputes, accessibility paths, and an outage drill.
- Ignoring limits until after award: Identify high-value debt, international, and unusual payment cases before shortlisting.
- Leaving exports for contract closeout: Test a complete export and document token migration during implementation.
- Buying hardware before selecting the service: Confirm certification, network, support, and purchasing compatibility first.
A practical decision sequence
- Inventory every payment program, channel, method, limit, currency, refund rule, and legal constraint.
- Quantify five years of volume and cost by payment method, including peak periods and dispute assumptions.
- Publish pass/fail requirements for PCI evidence, security authorization, accessibility, data rights, and mandatory channels.
- Request technical, operational, security, accessibility, and commercial evidence—not only a rate card.
- Run scripted demonstrations for payment, refund, reconciliation, dispute, outage, and assisted-access scenarios.
- Score five-year economics alongside risk, public experience, operations, coverage, and portability.
- Negotiate service levels, incident duties, audit cooperation, export and transition rights, and measurable accessibility obligations.
- Authorize production only after the agency validates its own configuration, integrations, controls, and operating procedures.
Bottom line
Government agencies should select a payment processor as an operating, security, and public-service partner—not as a commodity rate. The winning proposal is the one that can document its PCI and cloud responsibilities, serve every required audience and channel, reconcile cleanly, contain fraud and disputes, remain accessible and reliable, and leave the agency in control of its data and exit path. Transaction fees belong in the model, but they should be scored after the agency knows the full cost and risk of collecting money from the public.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
