Key takeaways
- Match the authorization pattern to the format: vending knows the price first, coolers find out after the door closes, kiosks scan first.
- Size the pre-authorization from your own basket data, near the 95th percentile, and tell shoppers about the temporary hold.
- Offline acceptance with per-card and per-device caps usually loses far less than refusing every sale during an outage.
- Badges, payroll deduct and subsidies turn checkout into an HR program. Cap them per person and per shift from day one.
- Fixed per-transaction fees dominate small tickets. Multi-item baskets dilute them.
A shopper at a smart cooler taps a phone, opens the door, takes a sandwich and a sparkling water, and walks away. They experienced one gesture. The system experienced at least five events: a tap, an authorization for an amount nobody knew yet, a door release, a basket assembled by sensors, and a capture after the door closed. Each event is a design decision, and each one fails in its own way at 3 a.m., when nobody is there to apologize.
This guide covers the choices behind that one gesture: authorization patterns, pre-auth sizing, declines and outages, and badge, payroll deduct and subsidy programs that don’t surprise finance.
Three formats, three authorization patterns
The core question is simple: when does the system know the price?
| Format | When the amount is known | Typical pattern | Main risk |
|---|---|---|---|
| Spiral vending machine | Before payment, because the shopper picks a slot | Authorize, vend, then capture the exact amount, or reverse it if nothing drops | Charging for a product that hung on the coil |
| Smart cooler | After the door closes | Pre-authorize a hold, release the door, capture the actual basket | Baskets larger than the hold; holds that confuse shoppers |
| Micro-market kiosk | Before payment, because the shopper scans first | A standard retail sale for the exact amount | Unscanned items rather than payment failures |
Vending’s risk is mechanical. Kiosks behave like any retail checkout. Smart coolers are the interesting case, because the shopper commits before the cart exists.
Sizing the pre-authorization
A pre-authorization places a temporary hold on the shopper’s card. After the door closes, the system captures the actual amount and the rest of the hold is released. Choosing the hold amount is a trade-off with a bad answer at each extreme.
| Hold strategy | What happens | Who it hurts |
|---|---|---|
| Nominal (say $1) | Confirms the card is live, but most baskets exceed what you authorized | The operator, through overages it may not be able to collect |
| Matched to baskets (near the 95th percentile) | Covers almost every basket at a familiar amount | Few people: a small, known share of baskets exceed it |
| Very high | Every basket is covered | Debit-card shoppers: bigger pending holds, more declines, more “why was I charged $50?” emails |
Use your own data. Suppose a cooler’s last 90 days show a median basket of $6.80, a 95th percentile of $14.20 and a 99th percentile of $21.50. A $15 hold covers roughly 95% of baskets outright. Then decide in advance what happens to the rest. Some processors and card types support an incremental authorization for the difference; where they don’t, the overage is a known, budgeted loss. What you can capture beyond the original authorization depends on card-network rules and your processor, so get that answer in writing before you set policy.
Two messages prevent most complaints. Before the tap, the screen says: “A temporary hold of up to $15 is placed. You’re charged only for what you take.” After the door closes, a receipt arrives quickly, ideally before the shopper is back at their desk, with item names and the final amount. How long a pending hold stays visible is up to the card issuer, which is exactly why the receipt matters more than the hold.
Decline handling: fail before the door opens
The best decline is one that happens before the door opens. Pre-authorization gives you that: if the hold is declined, the door stays shut. Design that moment with care.
- Say what happened in plain words. “Card declined. Try another card or pay with the app.” Not an error code.
- Offer the next method on the same screen. A QR code for app payment rescues many sales when a card fails or a phone’s NFC is switched off.
- Don’t loop the same card. Repeated attempts on a declined card rarely succeed and can trip fraud checks at the issuer. Allow one retry, then suggest an alternative.
- Log declines by reason and by device. A cluster of declines at one cooler is usually a reader or connectivity fault, not a run of bad cards.
The harder case is the decline that arrives after the goods are gone. That happens when a device accepted a payment offline.
Offline: refuse every sale, or accept a little risk?
Every network drops eventually, and then the device has two choices. It can refuse card sales until it reconnects, or it can accept cards offline, store the transactions and submit them when the link returns.
Run the numbers for a typical overnight outage. A hospital cooler loses connectivity from midnight to 6 a.m. and sees 22 transactions averaging $7.40, or $162.80 in sales. If one in twenty of those fails on submission, the loss is about $8. If the cooler had refused every sale instead, the loss would be the full $162.80, plus a night-shift nurse who learns not to count on it.
Offline acceptance is usually the better bet, inside limits:
- a per-card cap on offline spend, so one card covers one basket, not ten
- a per-device ceiling on total offline value, after which the device stops accepting
- a local block list of cards that failed before
- a time limit by which buffered transactions must be submitted
Anything with compliance attached deserves stricter rules. Age-restricted compartments, for example, should fail closed whenever the device can’t verify.
Beyond the card: badges, payroll deduct and subsidies
Workplaces, hospitals, campuses and plants often want payment methods that look nothing like retail. These methods change who pays and who carries the risk.
| Method | Best for | Setup work | Watch out for |
|---|---|---|---|
| EMV contactless cards and mobile wallets | Every site, including visitors | Reader and processor | Holds on debit cards; NFC turned off |
| App or QR | Loyalty, itemized receipts, a fallback when a reader fails | App enrollment | Download friction for one-time shoppers |
| Employee badge | Badge-controlled sites with fast repeat purchases | Badge-to-account mapping through the host’s identity system | Lost or shared badges |
| Payroll deduct | Workforces with limited card access; no card fees on those sales | HR policy, written employee authorization, a payroll file or API connector | State wage-deduction rules; employees who leave with open balances |
| Employer subsidy | Amenity programs, healthy-choice nudges, night-shift support | A rules engine with caps and a named budget owner | Open-ended cost without per-person limits |
Payroll deduct needs special care. Deductions from wages are regulated, and the requirements, including written employee authorization, vary by state. The host’s payroll and legal teams should own the policy. The vending system’s job is to enforce limits and produce clean, auditable files. For how these programs fit into office pantries, see our page on office smart vending.
Worked example: a night-shift meal subsidy
A hospital with about 300 staff on site each night wants to subsidize fresh meals: $3 off any meal between 10 p.m. and 6 a.m. Finance asks what it will cost.
- If 40% of night staff use it once per shift: 300 × 0.40 = 120 meals a night, or 120 × $3 = $360 a night, which is $131,400 a year
- If participation climbs to 60%: 180 meals a night, $540 a night, $197,100 a year
- If every person used it every night: 300 × $3 × 365 = $328,500 a year
The rule that makes this approvable is the cap: one subsidized meal per badge per shift, enforced automatically. With it, finance knows the worst case before signing. Subsidies also work better as targeted nudges than blanket discounts, such as 50% off fruit and salads, or a hot-meal subsidy only on nights the cafeteria is closed.
The economics of small tickets
Card processing usually combines a percentage with a fixed per-transaction fee, and on small tickets the fixed part dominates. Here’s a processing markup of 0.35% + $0.05 on top of interchange:
| Ticket | Markup | Markup as a share of the ticket |
|---|---|---|
| $1.75 soda | $0.056 | 3.2% |
| $2.50 snack | $0.059 | 2.4% |
| $8.00 cooler basket | $0.078 | 1.0% |
| $14.00 cooler basket | $0.099 | 0.7% |
Interchange schedules typically include a fixed component too. That’s one reason smart coolers, where a basket often holds more than one item, process more efficiently than single-item vending. It’s also a reason to resist adding a cashless convenience fee. It recovers a few cents and teaches shoppers that the machine penalizes the way most of them prefer to pay.
Receipts, refunds and disputes
An unattended store can’t apologize in person, so refunds have to be fast and self-serve.
- Send the receipt within seconds of the door closing, with item names, not just a total.
- Put a “something’s wrong with my order” link on the receipt, and settle small claims automatically under a threshold you set.
- Keep the evidence: door events, sensor readings and the reconciled basket. When a shopper disputes an item, a system that fuses vision and shelf weight can show what actually left the shelf, as covered in how smart coolers know what you took.
- On spiral machines, refund automatically when the drop sensor sees nothing fall. A refund the shopper never had to request is the cheapest goodwill in retail.
Declines, failed offline captures and refunds are all forms of revenue that leaked between the shelf and the bank, which is why they belong in your shrink accounting alongside theft and spoilage.
Checklist: before you go live
- Authorization pattern chosen for each format
- Pre-auth amount set from basket data and disclosed on screen
- Policy for baskets above the hold, confirmed with your processor
- Decline message and a fallback payment method on the same screen
- Offline caps per card, per device and per time window
- Subsidy and payroll deduct rules capped per person per period, approved by the host’s HR and finance teams
- Receipts within seconds and a self-serve refund flow
- Decline, offline and refund reports reviewed weekly, by device
How 8Kava approaches this
Kava Cooler releases its door in under a second after a tap and finalizes the receipt within 10 seconds of the door closing. It accepts EMV contactless cards, mobile wallets, the Kava app or QR code, employee badges and payroll deduct, and every 8Kava device buffers transactions for up to 72 hours offline. Subsidy and payroll deduct programs connect with HRIS and payroll systems through file or API connectors. You can bring your own processor at no markup or use Kava Pay at interchange-plus 0.35% + $0.05, and we never add a convenience fee for shoppers.
Program design is covered on Payments & Loyalty, hardware details on the smart cooler page, and our P2PE-capable reader approach on Security & Trust. If you’re also choosing a processor, our platform lock-in checklist covers the contract side.