You can take a credit card payment without a machine by keying the card details into a web-based virtual terminal, entering them in a mobile payment app, or sending the customer a secure payment link they fill in themselves. All three run through a merchant account or a payment service like Square, Stripe, or PayPal, and all three are treated as “card not present” transactions, which carry higher fees and more fraud exposure than a swipe or chip read.
Set Up a Way to Process Payments First
Before you can accept a single keyed-in charge, you need a formal relationship with a payment processor. That can be a dedicated merchant account through a traditional acquirer, or an account with a payment service provider that groups many small businesses under one master merchant account. Either route gives you access to the card networks and handles the communication with the cardholder’s bank.
Signing up produces a merchant identification number that identifies you on every transaction and ties your activity together for settlement, reporting, and disputes. Without one, there is no way to move funds from the cardholder’s account into yours.
Expect to pay more than you would for a swiped sale. Keyed-in rates typically run around 2.9% plus $0.30 per transaction on the low end and up to about 3.5% plus $0.15 on the higher end, depending on the processor, your monthly volume, and the card brand. Some providers also charge a monthly gateway fee for virtual terminal access, so ask about that upfront.
What to Collect From the Cardholder
Every keyed transaction needs the same handful of data points. Any one of them wrong triggers an immediate decline.
- The full cardholder name as printed on the card.
- The card number: 16 digits for Visa, Mastercard, and Discover; 15 digits on most American Express cards.
- The expiration month and year.
- The CVV: three digits on the back for Visa, Mastercard, and Discover; four digits on the front for American Express.
- The billing zip code tied to the cardholder’s address at the issuing bank.
The card number and expiration date are the minimum the network needs to attempt an authorization.1Elavon. Commerce SDK – Manual Card Data Entry The CVV confirms the person providing the number has, or recently had, the physical card. The billing zip runs through the Address Verification System (AVS), which checks it against what the issuing bank has on file. A mismatch on either does not always block the charge automatically, but it should make you think twice before shipping goods or delivering the service.
Three Ways to Enter the Payment
Virtual Terminals
A virtual terminal is a web page inside your processor’s dashboard that behaves like a digital countertop card machine. You sign in from any browser, type the customer’s card details into the form, and submit. It works from a laptop at home or a desktop in a back office and is the standard tool for phone orders, service businesses billing after a job, and anywhere a customer reads their card number to you.
Mobile Payment Apps
Most major processors offer smartphone and tablet apps with a manual entry option alongside the card reader function. The apps rely on the device’s built-in security, including biometric login, to protect your merchant credentials. For a technician wrapping up at a customer’s home or a vendor whose reader has died mid-market, keying the card into the app finishes the sale on the spot.
Payment Links and Digital Invoices
A payment link moves the data entry to the customer. You generate a unique URL through your processor and send it by email or text. The customer clicks it, lands on a secure hosted page, and enters their own card details. You never see or touch the card number, which cuts your fraud liability and shrinks your security obligations. Digital invoices work the same way, with the payment link embedded in a billing document, which suits business-to-business work where both sides want a paper trail.
Whichever tool you pick, the processor replaces the actual card number with a random string called a token before the data crosses the network. An intercepted token is useless. Systems that only ever handle tokens can also fall outside the scope of annual PCI compliance assessments, which is one less thing to manage.2PCI Security Standards Council. PCI DSS Tokenization Guidelines Information Supplement
What Happens After You Submit
When you hit submit, the processor sends an encrypted authorization request to the cardholder’s issuing bank. The bank checks available credit, compares the CVV and AVS data against its records, and returns an approval or decline within a few seconds. An approval earmarks the funds for settlement into your account, usually within one or two business days. A decline comes back with a response code pointing at the reason: insufficient funds, a security block, a data mismatch. When something declines, have the customer double-check the card number and billing zip before you try again.
Once the payment goes through, send a receipt by email or text. Federal law limits electronically printed receipts to no more than the last five digits of the card number, and the expiration date cannot appear at all.3Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports Include the transaction amount, the date, and your business name. Virtual terminals and payment apps generate compliant receipts automatically; if you build your own invoice templates, make sure the card number is properly truncated.
Fixing a Mistake: Void or Refund
How you undo a charge depends on timing. Before your processor runs its daily settlement batch (typically overnight), you can void the transaction outright. A void cancels the authorization before any money moves, and the hold on the customer’s account simply drops off. After the batch settles and the funds have transferred, a void is no longer available and you have to issue a refund, which posts as a separate credit and can take several business days to appear on the customer’s statement.
Voids are cleaner. The customer never sees a charge come and go, and you avoid paying processing fees on a settled transaction that then gets reversed. If you catch the error, act before the nightly batch closes.
Fraud and Chargeback Risk
Card-not-present transactions account for the majority of credit card fraud in the United States, and the merchant almost always absorbs the loss. When a cardholder disputes a charge and the bank issues a chargeback, you lose the sale amount, the product or service you already delivered, and usually a chargeback fee on top. CNP chargeback rates run roughly 0.6% to 1% of transactions, meaningfully higher than for in-person payments.
CVV matching and AVS checks are your first line of defense. A few habits do most of the rest of the work:
- If both the street address and the zip code fail AVS (an “N” response), don’t fulfill the order. That combined mismatch is one of the strongest fraud signals you’ll see.
- Watch for patterns that don’t fit your usual business: multiple transactions in quick succession, orders much larger than a normal sale, or a shipping address that doesn’t match the billing address. Call the customer before processing.
- Keep documentation. Emails, signed contracts, delivery confirmations, and any customer communication decide whether you win a chargeback dispute.
- Use payment links when the situation allows. Letting the customer enter their own card on a hosted page keeps you out of the data stream and strengthens your position if the charge is later disputed.
Some processors offer 3D Secure authentication for keyed and online transactions, adding a bank-side verification step before the payment completes. When a transaction clears 3D Secure, fraud liability generally shifts from the merchant to the issuing bank. Not every virtual terminal supports it, but if yours does, turning it on is one of the more effective chargeback protections available.
Keeping Card Data Secure
Any business that accepts credit cards must comply with the Payment Card Industry Data Security Standard, which governs how card data is encrypted, stored, transmitted, and destroyed.4PCI Security Standards Council. PCI DSS Quick Reference Guide For merchants keying in transactions, a handful of rules come up daily:
- Never store the CVV. The security code cannot be retained after authorization, on paper or in any digital form.
- Limit what you keep. If you have to retain card data for recurring billing, it must be encrypted and access-restricted. Better still, use your processor’s token vault so real card numbers never sit in your systems.
- Destroy paper properly. Any handwritten order form, fax, or printout that contains a full card number has to be cross-cut shredded or incinerated. The recycling bin isn’t an option.
- Restrict access to employees whose jobs actually require handling card data, for both digital systems and paper records.
The simplest way to shrink your compliance burden is to route payments through hosted payment pages and tokenization so that actual card numbers never touch your own systems.
A Note on Surcharges and Tax Reporting
Two things sit next to keyed payments and are easy to assume wrongly. First, if you plan to pass the higher processing cost to the customer as a surcharge, the card networks impose caps, disclosure rules, and advance-notice requirements, and several states (including Connecticut, Massachusetts, and Maine) prohibit credit card surcharges outright.5Mastercard. Mastercard Credit Card Surcharge Rules and Fees for Merchants Debit cards cannot be surcharged regardless of how they’re processed. Check the network rules and your state law before adding one.
Second, if you process through a third-party settlement organization like Square, Stripe, or PayPal, the processor will issue you a Form 1099-K once you exceed $20,000 in gross payments and 200 transactions in a calendar year. The One, Big, Beautiful Bill reinstated those thresholds after several years of delays around a lower $600 threshold.6Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One, Big, Beautiful Bill Traditional merchant accounts generally fall outside 1099-K reporting, but the income is still taxable. Make sure your processor has your correct Taxpayer Identification Number on file; if it doesn’t, the processor may be required to withhold 24% of your payments and send it to the IRS.7Internal Revenue Service. Notice 2025-33 – Backup Withholding