MOTO payments are Mail Order/Telephone Order card transactions, meaning a customer gives their card number to a merchant by phone, fax, or paper form and the merchant keys that information into a payment system by hand. Because the physical card is never present at the sale, card networks classify MOTO as a card-not-present transaction, which changes the fees you pay, the compliance rules you follow, and who eats the loss when a charge is disputed.
How MOTO Differs From Online and In-Person Payments
The defining feature is the manual handoff. A customer reads a card number over the phone or writes it on an order form, and a staff member types it into a virtual terminal. That is different from e-commerce, where the cardholder types their own details into a website, and different from in-person sales, where a terminal reads the chip, stripe, or contactless signal directly.
Card networks treat MOTO differently from online purchases even though both are card-not-present. Online transactions can use tools like 3-D Secure to authenticate the cardholder in real time. MOTO transactions cannot, because the customer is on a phone call or mailing a form, not sitting at a browser. That distinction shapes interchange pricing, chargeback rules, and which security checks apply.
What You Need to Accept MOTO Payments
The core tool is a virtual terminal, a web-based application you log into from an internet-connected computer to key in card data. It is the browser equivalent of the countertop card machine used in retail, except you type the numbers rather than swipe a card. Your payment processor or merchant service provider supplies access to the virtual terminal as part of your merchant account.
Monthly fees vary by provider. Wells Fargo charges a $9.95 monthly merchant account fee per location plus a $10 monthly PCI compliance program fee.1Wells Fargo. Merchant Services Fees Other processors bundle virtual terminal access into their transaction pricing without a separate monthly charge, so it pays to compare.
Merchants using a virtual terminal must complete a PCI Self-Assessment Questionnaire known as SAQ C-VT. It is a streamlined version of the full PCI assessment, but it still requires that the computer running the virtual terminal is isolated from other systems on your network, that no software on that computer stores cardholder data, and that no card-reading hardware is attached to it.2PCI Security Standards Council. Self-Assessment Questionnaire C-VT If your staff keys card numbers into a CRM or billing system that connects to a payment gateway, the compliance requirements expand beyond SAQ C-VT.
How a MOTO Transaction Moves Through the System
Once the operator submits the card number, expiration date, and billing information in the virtual terminal, the data passes through several checkpoints in seconds.
- The virtual terminal sends encrypted data to a payment gateway, which acts as a secure relay to the banking system.
- The gateway forwards the request to the merchant’s acquiring bank, the bank that holds the merchant account.
- The acquiring bank routes the transaction through the appropriate card network (Visa, Mastercard, and so on) to reach the cardholder’s issuing bank.
- The issuing bank checks available credit or funds, runs fraud screening, and returns either an authorization code or a decline.
After authorization, the charge sits pending until batch settlement, which most processors run nightly. Funds typically deposit to the merchant account within one to three business days.
Authentication and PCI Rules
Without a chip or PIN to verify the cardholder, MOTO relies on two main tools.
The Address Verification Service (AVS) compares the billing address the customer provides against the address on file with their card issuer. The virtual terminal prompts for the postal code and street number, and the issuing bank validates that data before authorizing the payment.3Adyen Docs. Mail Order/Telephone Order (MOTO) – Section: Address Verification Service A mismatch can trigger a decline or a manual review.
The card verification value (CVV) is the three- or four-digit code printed on the physical card. Asking for it during a phone order gives some assurance that the caller has the card in hand rather than just a stolen number. The catch: PCI DSS Requirement 3.2 prohibits storing CVV data after the transaction is authorized. The code must be entered, used for authorization, and discarded. Writing it down for later, saving it in a spreadsheet, or keeping it in a customer database violates the standard even if the customer gave permission.4PCI Security Standards Council. FAQ – Can Card Verification Codes/Values Be Stored for Card-on-File or Recurring Transactions
PCI DSS compliance is mandatory for any merchant that handles card data. Beyond the CVV prohibition, the standard bars storing full card numbers on local machines after authorization and requires encryption of cardholder data during transmission. Non-compliance can lead to monthly fines from card brands ranging from $5,000 for smaller merchants to $100,000 for large enterprises, and those penalties keep accruing until the issues are fixed. A data breach while non-compliant can end your ability to accept cards entirely.
What MOTO Transactions Cost
MOTO transactions cost more than in-person sales because networks price risk into every transaction. When a chip is read at a terminal, the fraud rate is low and the interchange fee reflects that. When a merchant keys in a number over the phone with no way to physically verify the card, the network charges more.
Visa’s published interchange schedule shows card-not-present rates for standard consumer debit at 1.65% plus $0.15 per transaction, with downgraded or standard-tier transactions reaching 1.90% plus $0.25.5Visa. Visa USA Interchange Reimbursement Fees Credit cards and premium rewards cards carry higher rates. Mastercard’s keyed-entry credit rates run from about 1.95% for basic consumer cards to 2.70% for corporate cards. Add your processor’s markup, and the total percentage you pay on a MOTO transaction typically lands between 2.5% and 3.5% depending on the card type and your processing agreement.
Interchange Downgrades
Every card network has qualification tiers that determine which interchange rate applies. If you fail to collect certain data points, the transaction drops to a more expensive tier. Skipping AVS data on a keyed-in Visa transaction can increase the interchange rate by 17% to 64% depending on the pricing model. A business processing several hundred thousand dollars in MOTO volume a year can lose tens of thousands to unnecessary downgrades. Collecting the billing zip code and CVV on every call is the easiest way to avoid this.
Monthly and Incidental Fees
Beyond per-transaction costs, MOTO merchant accounts often carry monthly minimums. If your total processing fees fall below a negotiated minimum (commonly $25 to $35), you pay the difference. PCI compliance fees of around $10 per month are standard.1Wells Fargo. Merchant Services Fees Some processors also charge statement fees, batch fees, or gateway access fees. Read the merchant processing agreement line by line before signing.
Chargeback Liability
This is where MOTO merchants take the biggest financial hit. In a card-present transaction, liability for fraud shifts to the card issuer once the chip is read. In a MOTO transaction, no chip is read, no authentication protocol runs, and the merchant bears full liability for fraudulent chargebacks.6Visa. Dispute Management Guidelines for Visa Merchants
When a cardholder tells their bank they didn’t authorize a phone order, the dispute falls under Visa’s Condition 10.4 (fraud in a card-absent environment) or similar codes on other networks.7Stripe. Dispute Reason Codes The merchant loses the transaction amount, pays a chargeback fee (typically $15 to $25), and the disputed funds are pulled from the merchant account. Card-not-present fraud is roughly 81% more likely than point-of-sale fraud, so the exposure is real.
To fight a MOTO chargeback, you need what the card networks call “compelling evidence.” That means records showing the cardholder’s name and billing address matched, that AVS and CVV checks passed, and ideally a record of prior successful transactions with the same customer. A ship-to address matching the billing address strengthens your case. For phone orders, keep a log of the call date, time, and operator who took the order. None of this guarantees you win the dispute, but without it you lose automatically.
A practical rule from Visa’s guidelines: do not deposit the transaction receipt with your acquiring bank until you have shipped the merchandise.6Visa. Dispute Management Guidelines for Visa Merchants Charging before shipping is one of the most common triggers for disputes.
FTC Shipping and Refund Rules for Phone and Mail Orders
If you take orders by phone or mail, the FTC’s Mail, Internet, or Telephone Order Merchandise Rule applies directly to your business. Under 16 CFR Part 435, you must have a reasonable basis to believe you can ship the merchandise within the time stated in your advertising. If no shipping timeframe is stated, you have 30 days from receiving a properly completed order. When the buyer applies for credit from the seller to pay for the order, that window extends to 50 days.8eCFR. 16 CFR Part 435 – Mail, Internet, or Telephone Order Merchandise
If you cannot meet the deadline, you must notify the customer and get their consent to the delay. If the customer refuses or you cannot reach them, you must issue a prompt refund without being asked. “Prompt” means within seven working days for most payment methods, or within one billing cycle for credit card charges.8eCFR. 16 CFR Part 435 – Mail, Internet, or Telephone Order Merchandise Ignoring these deadlines can trigger FTC enforcement action.
MOTO Is Not the Same as Recurring Billing
A common misconception is that you can use the MOTO classification to set up recurring subscriptions from a phone order. You cannot. Card networks and processors treat MOTO as a one-time, customer-initiated transaction using fresh billing details. Once you store a customer’s card for future charges, the transaction type shifts to “card on file” or “recurring,” which falls under different network rules and interchange categories.9Recurly. MOTO Transactions
Misclassifying a recurring charge as MOTO can lead to compliance violations. In regions governed by Strong Customer Authentication rules (primarily the EU and UK), MOTO transactions are out of scope for SCA requirements because they are not electronic commerce.10Visa. Out of Scope and Exempt Transactions Tagging a recurring online charge as MOTO to sidestep authentication is the kind of misuse that triggers regulatory penalties. If a customer calls to place a first order and wants automatic monthly shipments, process the initial charge as MOTO and set up the recurring billing separately under the correct transaction type.
How to Reduce Risk as a MOTO Merchant
MOTO will always carry higher costs and greater fraud exposure than in-person payments. A few practices narrow the gap:
- Collect AVS and CVV on every transaction. Skipping these fields costs you twice, through interchange downgrades and through weakened chargeback defense.
- Never store card data locally. Let your virtual terminal provider handle storage and tokenization. Writing down a card number or saving it in a spreadsheet expands your PCI scope and your breach liability.
- Ship before settling. Authorize when the order is placed, but don’t capture the funds until the product ships.
- Keep detailed order records. Log the date, time, operator name, items ordered, and shipping address for every phone order. These records become your evidence months later if a chargeback arrives.
- Review interchange statements monthly. Look for downgraded transactions and trace them to missing data fields. Fixing a single recurring data-entry gap can save hundreds a month.