To take credit card payments over the phone, you need three things working together: a merchant account approved for card-not-present activity, a virtual terminal to key in the card details, and a routine that keeps you inside the Payment Card Industry Data Security Standard. Phone sales are classified as Mail Order/Telephone Order (MOTO) transactions because the card is never physically read, and that classification drives everything else: higher processing fees, higher fraud risk, and stricter rules about what you can hear, write down, or record.
What You Need Before the First Call
A merchant account is the account that holds funds after a card sale clears and before the money moves to your business bank account. You open one through a payment processor or a third-party gateway. Not every processor supports MOTO volume, so confirm that card-not-present transactions are explicitly approved on your account before you sign.
The virtual terminal is a web application you open in a browser on a computer, tablet, or phone. You log in, type the customer’s card details into the on-screen fields while they read them to you, and the software routes the transaction through the same banking networks a physical card reader would. No hardware beyond an internet-connected device is required. Most processors bundle a virtual terminal into the standard package; a few charge an extra monthly fee for it.
What It Costs
Card-not-present transactions cost more to process than in-person sales because the fraud risk is higher. Expect per-transaction fees in the range of 2.9% to 3.5% of the sale amount, plus a flat fee of roughly $0.15 to $0.49 per transaction. Interchange-plus pricing can bring the effective rate down for higher-volume merchants, but the base interchange rates Visa and Mastercard set for manually keyed entries stay higher than the rates for chip reads.
Watch the recurring charges too. Monthly gateway or subscription fees range from nothing with processors like Square and Stripe to more than $100 per month on subscription pricing plans. Some processors add a separate PCI compliance fee, and a few charge a non-compliance fee if you haven’t completed your annual self-assessment questionnaire.
What to Collect on the Call
Once the customer is on the line and the virtual terminal is open, you need five pieces of information. Type each one directly into the terminal as the customer speaks. Never write card details on paper, sticky notes, or a scratch pad, even for a moment.
- Cardholder name as it appears on the card.
- The 15- or 16-digit card number on the front.
- Expiration month and year.
- The CVV: three digits on the back of Visa, Mastercard, and Discover cards, four digits on the front of American Express. This is your single strongest fraud-prevention tool on a phone sale.
- Billing zip code, which triggers the Address Verification Service (AVS) check against the address the issuing bank has on file.
AVS returns a result code. A full match on street and zip is the best outcome and your strongest evidence if the transaction is later disputed. A zip-only match warrants a quick verbal confirmation with the customer. A complete mismatch is a red flag worth resolving before you submit the sale.
Running the Transaction
After confirming the entries are correct, submit the transaction. The virtual terminal encrypts the data and sends it through the payment gateway to the customer’s issuing bank. Within a few seconds you get one of three responses. Approved means the bank has verified the account and placed a hold on the funds. Declined means the transaction failed, often for insufficient funds or an expired card. Referral means the bank wants extra verification, and you may need to call the number provided to complete the authorization manually.
An approval produces an authorization code, but the money hasn’t moved yet. Settlement, the actual transfer from the customer’s bank to yours, typically lands one to three business days after the transaction. Most processors batch-settle at the end of each business day. Faster settlement is usually available for an added fee.
Send a digital receipt to the customer’s email or phone as soon as the sale is approved. Documented receipts cut down on disputes because the customer has a clean record of what was charged, when, and by whom. Keep your own copy of every transaction record: authorization code, date, amount, and the last four digits of the card.
Refunds go through the same virtual terminal. Pull up the original transaction, issue a credit for the full amount or a partial amount, and the funds return to the same card. Refunds typically take five to ten business days to appear on the customer’s statement, so tell them what to expect.
Staying PCI Compliant
Any business that handles card data over the phone falls under the Payment Card Industry Data Security Standard, the security framework the major card networks maintain. PCI DSS version 4.0 is the current standard and applies regardless of transaction volume. The rules are contractual obligations baked into your merchant agreement, enforced by the card brands through your acquiring bank.
What You Cannot Store
You are prohibited from retaining sensitive authentication data after a transaction is authorized. The CVV, the full magnetic stripe data, and the PIN must not exist anywhere in your systems, recordings, or paper files once the sale is complete. PCI DSS Requirement 3.2 makes this explicit, with no exception for convenience or record-keeping. The full card number also should not be stored unless you have a genuine business need and the infrastructure to protect it, which most small businesses do not.
Penalties
PCI DSS fines are not government penalties. They flow from the card brands through your acquiring bank to you, under the terms of your merchant agreement. The commonly cited range is $5,000 to $100,000 per month of continued non-compliance, scaling with transaction volume and how long the violation persists. A business found non-compliant after a data breach can also lose its ability to accept credit cards entirely.
Training and Workspace
PCI DSS Requirement 12.6 requires every employee who handles card data to complete security awareness training at hire and at least once each year afterward. Employees must acknowledge in writing, on paper or electronically, that they’ve read and understand your security policies. In a breach investigation, one of the first things an auditor checks is whether these training records exist and are current.
Training should cover the basics that matter for phone payments: never write down card numbers, never share virtual terminal login credentials, lock the workstation when stepping away, and report anything suspicious immediately. Keep signed acknowledgment forms or digital completion records on file. Retrain anyone who moves into a role that involves card data.
The workstation itself belongs in a controlled area rather than at a shared desk in an open hallway. A dedicated machine used only for payment processing has a smaller attack surface than a general-purpose computer that also runs email and web browsing. Log out of the virtual terminal any time the workstation is unattended, and restrict physical access to the payment area to authorized staff.
Call Recording Without Breaking the Rules
Recording customer calls for quality assurance is common, but it collides with PCI DSS the moment a caller reads their card number aloud. If that audio is saved to a file, you have stored the full card number and possibly the CVV in your recording system, which violates the storage prohibition.
The simplest workaround is to pause the recording when the customer begins reading card details and resume it after. Most modern call recording platforms support this manually or through automated triggers. The weakness is human error: forget to pause, and card data ends up in the recording.
A more reliable approach is DTMF masking. The customer types their card number on their phone’s keypad instead of speaking it. The system intercepts the tones and replaces them with flat beeps before they reach the agent’s headset or the recording. Payment data routes directly to the processor without entering your call center environment. A properly deployed DTMF masking system can remove your telephony infrastructure from PCI DSS scope entirely.1PCI Security Standards Council. Protecting Telephone-Based Payment Card Data v3-0
At higher volumes, a fully automated Interactive Voice Response (IVR) system takes agents out of the loop. The customer calls a dedicated payment line, enters card details on the keypad, and receives a text or email confirmation. No agent hears or sees card data.
Recording law is a separate concern from PCI. Under federal law, at least one party to the call must consent to a recording, and violations can bring fines and up to five years of imprisonment.2Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Several states require all parties on the call to consent. Announcing at the start of every call that it may be recorded satisfies both one-party and all-party consent rules.
Chargebacks and Fraud Liability
Phone payments are where merchants absorb the most loss, and it’s the area most businesses underestimate. In a chip transaction, liability for fraud shifts to the card issuer. In a MOTO transaction, that shift never happens. If a stolen card number is used to place a phone order, the merchant absorbs the loss. Because the transaction can’t be verified in real time through chip or 3D Secure authentication, the card brands assign the fraud risk to the business.
A cardholder can dispute a charge with their issuer within 60 days of the statement date showing the charge.3Consumer Advice – FTC. Using Credit Cards and Disputing Charges When a chargeback comes in, your processor debits the transaction amount from your account plus a chargeback fee, typically $20 to $100. If your chargeback ratio climbs above roughly 1% of total transactions, you risk being placed in a card brand monitoring program with escalating penalties.
You can contest a chargeback through representment, but you need documentation to win. For phone transactions, keep records of the cardholder name, the last four digits of the card, the transaction amount, a description of what was sold, the shipping address if physical goods were involved, and any proof of delivery.4Bureau of the Fiscal Service. Chargeback and Exception Processing Guide A signed delivery confirmation to the billing address is your strongest piece of evidence in a fraud dispute.
Winning MOTO chargebacks is harder than winning card-present disputes because you can never prove the actual cardholder authorized the transaction. Your best defense is prevention: collect the CVV and billing zip code every time, verify AVS results before submitting the sale, and send an immediate receipt to the contact information the customer provides.
Tokenization for Repeat Customers
If the same customers call you regularly, collecting full card details on every call is both tedious and risky. Tokenization replaces the card number with a randomly generated string that means nothing outside your processor’s system. When the customer calls again, you look up their account and charge the token; the actual card number never touches your environment after the first sale.
Tokens cannot be reverse-engineered to recover the card number, so even if your system is breached, the stolen tokens are useless to an attacker. Tokenization also reduces your PCI DSS scope, because your systems no longer store, process, or transmit the real card number for returning customers. Most modern payment gateways include tokenization, often at no extra cost.
Surcharges and Tax Reporting
Some businesses add a surcharge to credit card transactions to offset the higher processing cost of phone payments. Visa caps surcharges at 3% of the transaction amount or your actual processing cost, whichever is lower, and surcharges cannot be applied to debit or prepaid cards.5Visa. U.S. Merchant Surcharge Q and A A handful of states prohibit credit card surcharges outright, so check your state’s rules before adding one. Disclose the surcharge before the customer provides card details, not after.
Your payment processor reports your gross transaction volume to the IRS on Form 1099-K if your annual receipts exceed $20,000 and you process more than 200 transactions in a calendar year. This threshold was reinstated under the One, Big, Beautiful Bill, reverting to the limit that was in place before the American Rescue Plan attempted to lower it.6Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One, Big, Beautiful Bill; Dollar Limit Reverts to $20,000 The income is taxable regardless of whether you receive a 1099-K, so keep your own transaction records and reconcile them against any form you receive. If the numbers don’t match, contact the processor to correct the 1099-K before you file.