Cart and Checkout Design: No Surprises at the Last Step

Where checkouts lose people

Most checkout problems are not technical. A shopper adds a $79 item, reaches the last step and sees a delivery fee, a handling fee and a card fee they did not expect. Or the delivery options say "Standard" and "Express" without dates. Or the address form rejects a unit number. Each of these is fixable, and several are also legal issues in Australia.

Show the total price, early

The ACCC describes drip pricing as advertising a price at the start of an online purchase and then adding extra fees and charges along the way. Businesses must disclose at the start which fees will apply and when, and the displayed price must include taxes, duties and all unavoidable or pre-selected extra fees. Delivery fees do not have to be built into product prices if the customer can choose a free option such as free click and collect^[1].

The ACCC has acted on this. In January 2026 a car rental booking platform paid a $39,600 penalty after the ACCC issued infringement notices alleging it failed to display the total price as a single figure, with pre-selected extras left out of the early price; the ACCC notes that paying such a penalty is not an admission of a breach^[2]. We build carts that show a delivery estimate before checkout and never pre-select paid extras.

Card surcharges ended on 1 October 2026

Following the Reserve Bank's review, eftpos, Mastercard and Visa introduced "no-surcharge" rules from 1 October 2026, and the RBA says American Express and UnionPay also decided to remove surcharging, with PayPal's rule following on 5 October 2026^[3]. The ACCC confirms that businesses can no longer charge surcharges for card payments on those networks, while discounts for particular payment methods are still allowed if the full price is shown and the discounted price is no more prominent^[1]. If your checkout still adds a card fee, we remove it and help you decide how to reflect card costs in your prices. The surcharges guide has the detail.

Delivery choices people can understand

• Delivery options named by outcome, such as "Arrives in 3 to 5 business days", not just "Standard"
• A postcode estimate on the product page or in the cart, before the checkout starts
• Click and collect or free delivery thresholds explained in one line
• Delivery cut-off times shown for express options
• Remote area surcharges explained before the last step, if your carrier applies them

Forms that work on a phone

Checkout forms should ask only for what you need to deliver and contact the customer. We use the right input types so phones show the right keyboard, support address autocomplete where the platform allows it, keep error messages next to the field they relate to and avoid asking customers to re-enter information they have already given. WCAG 2.2 added a Level A criterion on redundant entry for exactly this reason, alongside criteria on target size and accessible authentication^[4].

Card data stays with the payment provider

Hosted checkouts and payment pages keep card numbers off your servers. Shopify, for example, states that its checkout is designed to meet PCI DSS version 4 requirements with no additional merchant work^[5]. On WooCommerce and other self-hosted stores we use hosted or embedded card fields from the payment provider. Under PCI DSS v4.0.1, the January 2025 revision of SAQ A asks merchants to confirm their site is not susceptible to attacks from scripts^[6], so we keep the scripts on checkout pages to a short, reviewed list.

Checkout work we do

What we will not do

We will not add countdown timers that reset, fake "only 2 left" messages, pre-ticked add-ons or other tricks that push people into buying. They work against shoppers rather than for them, and several sit badly with Australian Consumer Law. From 1 July 2027, the Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 also adds rules on drip pricing and subscriptions and a ban on unfair trading practices^[7][8]. We set checkouts up for those rules now.