Taking Phone Orders in WooCommerce: Entering Cards in Admin

On this page 8 sections

1. Creating an Order in WooCommerce Admin
2. How WooCommerce Manual Order Credit Card Payments Work: Three Options
3. Option 1: Send a WooCommerce Pay for Order Link
4. Option 2: MOTO-Enabled Gateway Plugins for Keyed Entry
5. Option 3: Using Your Processor's Virtual Terminal
6. PCI Rules for Staff Handling Card Numbers by Phone
7. Keyed Transaction Rates and Fraud Risk
8. Choosing Your Phone Order Setup: Next Steps

Key takeaways

• The safest way to take a WooCommerce phone order is usually an admin-created order plus a customer payment page link, so the shopper enters their own card.
• MOTO-capable gateway plugins let staff key cards inside WordPress, but they can pull your site and staff computers deeper into PCI scope.
• A processor's virtual terminal keeps card entry off your website, but you have to reconcile each charge with its WooCommerce order by hand.
• Keyed phone transactions generally cost more than card-present sales and carry higher fraud and chargeback risk, so verify before you ship.

Some customers still want to call. A wholesale buyer might need a custom quote, an older shopper might not trust online checkout, or someone might have a question before they commit. If you run a WooCommerce store, you need a reliable way to turn that call into a paid order. This guide explains how WooCommerce manual order credit card payments work and covers the three main ways to collect payment: sending a payment link, keying the card through a MOTO-enabled plugin, and charging it in a virtual terminal. It also explains which approach keeps your store safest from a PCI standpoint.

Creating an Order in WooCommerce Admin

Every method below starts in the same place. You build the order in the WordPress dashboard before you collect any payment.

1. Go to WooCommerce > Orders and choose Add order. Some versions label this button "Add new."
2. Search for an existing customer, or leave the customer field blank and enter billing and shipping details by hand.
3. Add products with Add item(s). Add any fees or shipping lines you need.
4. Click Recalculate so taxes and totals reflect the shipping address.
5. Set the status to Pending payment and save the order.

At this point the order exists, but no money has moved. How you collect payment determines your PCI exposure, your processing cost and how much reconciliation work follows.

Tip: Add a private order note with the caller's name, the call time and the staff member who took the order. If a dispute comes in months later, this record helps.

How WooCommerce Manual Order Credit Card Payments Work: Three Options

Here's how the three main approaches compare.

The sections below cover each option in detail.

Option 1: Send a WooCommerce Pay for Order Link

Once an order is saved as Pending payment, WooCommerce shows a Customer payment page link near the top of the order screen. That link opens a pay-for-order page on your storefront. The customer sees the order total and pays with any gateway you have enabled at checkout, including wallets like Apple Pay if your gateway supports them.

To send it:

• Open the Order actions dropdown, choose the option to email the invoice or order details to the customer, and click the update button. The email includes a payment link.
• Or copy the payment page URL and text it to the customer while you're still on the call.

Why This Is Usually the Best Choice for WooCommerce Phone Orders

• Staff never hear or see the card number. That's the biggest PCI win available to you.
• The transaction runs as a normal ecommerce payment. If your gateway uses 3-D Secure, the customer completes authentication on their own device.
• Records stay clean. The payment attaches to the order automatically, and refunds work from the order screen.

Watch-Outs

• The link only works while the order is unpaid. If an order sits too long, follow up or cancel it. If paid orders aren't updating, see our guide to WooCommerce orders stuck on pending payment.
• Depending on your WooCommerce version and settings, an order assigned to a registered customer may require that customer to log in before paying. Test the flow with a dummy account first.
• Don't have staff open the pay link themselves and type in the caller's card. That turns a staff computer into a card-entry device, and any 3-D Secure challenge will go to the cardholder's phone, not yours. If staff need to key cards, use Option 2 or Option 3.

Option 2: MOTO-Enabled Gateway Plugins for Keyed Entry

MOTO stands for mail order/telephone order. It's the card network category for transactions where the card isn't present and the customer isn't entering the details themselves. Some WooCommerce gateway plugins add an admin-side payment option. Staff open the order, enter the card number the caller reads out, and the plugin submits the charge flagged as MOTO.

What to Check Before Using WooCommerce MOTO Payments

Features vary widely by plugin and by gateway, so confirm the following with your provider:

• Is MOTO enabled on your account? Some gateways require approval before they'll accept MOTO-flagged transactions.
• Is the transaction actually flagged as MOTO? A keyed charge sent as a regular ecommerce transaction can trigger 3-D Secure prompts the customer can't complete, and it may be categorized differently for pricing.
• How does the card field load? A plugin that uses the gateway's hosted fields does a better job of keeping raw card data off your server than one that posts card data through your site.
• Who has access? Limit the capability to specific user roles. Every admin account that can take payments is a target.

The Trade-Off

The appeal is that payment and order stay linked in WooCommerce. The cost is scope. When staff key cards into your WordPress admin, the site, the hosting environment and every computer used for entry become part of your card data environment. A compromised plugin or a weak admin password now puts phone-order cards at risk too. If you've read our coverage of WooCommerce credit card skimmers, you know admin screens aren't immune.

Option 3: Using Your Processor's Virtual Terminal

A virtual terminal is a secure, browser-based payment screen hosted by your gateway or processor. Staff log in, key the card and run the charge. Many gateways include one, and it sits completely outside WordPress.

This is often the practical middle ground for a WooCommerce create order and charge card workflow when customers can't or won't use a link.

A Simple Virtual Terminal Workflow

1. Create the order in WooCommerce as Pending payment, as described above.
2. In the virtual terminal, enter the order number in the invoice or description field so the two records match.
3. Run the charge with full address and security code details so verification checks can run.
4. Back in WooCommerce, add the transaction ID to a private note and change the status to Processing.
5. Issue any later refunds in the virtual terminal, then record them in WooCommerce. A refund recorded in WooCommerce alone won't move money back to the card.

Pros and Cons

• Pro: Card data never touches your website. You can use a dedicated, locked-down computer for payments.
• Pro: The processor flags transactions as keyed or MOTO.
• Con: Manual reconciliation. At higher volumes, mismatched orders and missed status updates become a real bookkeeping problem.

MannyPay offers virtual terminals for keyed phone and mail orders along with payment gateways that connect to online stores, including WooCommerce.

PCI Rules for Staff Handling Card Numbers by Phone

PCI DSS applies whenever you accept card data, no matter how small your phone volume is. The self-assessment questionnaire you complete depends on how cards flow through your business. Our article on WooCommerce PCI compliance and choosing your SAQ walks through how hosting your own store affects that choice. In general, the less your staff and systems handle raw card numbers, the lighter your compliance work.

Practical rules for anyone taking phone orders:

• Never write card numbers down. No sticky notes, notebooks or "I'll enter it later" spreadsheets.
• Never keep the security code. PCI DSS classifies it as sensitive authentication data, which generally must not be stored after authorization.
• Don't accept cards by email, text or chat. If a customer sends one anyway, don't use it. Delete the message, ask them to pay through a link, and suggest they consider having the card replaced.
• Pause call recordings during card entry. If your phone system records calls, a recording that captures card details becomes stored card data.
• Use unique logins. Each staff member should have their own account in WordPress and in the virtual terminal. No shared passwords.
• Lock down payment computers. Keep them updated, use screen locks, and avoid general web browsing on them.
• Train and document. Write a one-page phone-order procedure and have staff acknowledge it.

PCI requirements change over time and depend on your specific setup. Treat this as general information and confirm your obligations with your processor or a qualified security assessor.

Keyed Transaction Rates and Fraud Risk

Why Keyed Orders Usually Cost More

Card networks generally price card-not-present and keyed transactions higher than chip or tap transactions because the fraud risk is higher. Exact costs depend on card type, your pricing model and how the transaction is categorized. Sending a properly flagged MOTO transaction with full address data helps ensure you're not paying for a worse category than necessary. For a breakdown of what each sale costs, see WooCommerce transaction fees and what you pay per sale.

Who Carries the Fraud Risk

With keyed MOTO transactions, the merchant generally bears the chargeback risk if the real cardholder later disputes the charge. When staff key the card, there's no liability shift comparable to what chip cards or 3-D Secure can provide. That's another reason a payment link, where the customer authenticates on their own device, is often the stronger option.

Red Flags on Phone Orders

• A new caller placing an unusually large order with rushed shipping
• A shipping address that doesn't match the billing address, especially a freight forwarder
• Several cards tried in a row after declines
• Pressure to skip verification or ship before payment clears
• Reluctance to receive an email or text link

Illustrative example: A store selling specialty kitchen equipment gets a call from a first-time buyer who wants three high-end mixers shipped overnight to an address in another state. The first card declines and the caller offers a second. A cautious response is to send a payment link to the email on file and hold shipment until the billing and shipping details check out.

Card testing and fake orders often surface first at your online checkout. Our guide to stopping WooCommerce fake orders and card testing covers defenses that also help screen phone orders.

Choosing Your Phone Order Setup: Next Steps

For most WooCommerce stores, the best approach is to build the order in admin and send a pay-for-order link. Keep a virtual terminal as a backup for customers who can't use a link. Consider a MOTO plugin only if you take enough phone orders that manual reconciliation becomes a real burden, and only once your site security is solid.

Before you decide:

1. Confirm which options your current gateway supports and whether MOTO is enabled on your account.
2. Write a short phone-order procedure for staff.
3. Review how keyed transactions are priced on your statement.

If you're comparing providers, our store owner's checklist for the best WooCommerce payment gateway is a good starting point. You can also explore MannyPay's WooCommerce payment processing integration or request a free quote. A MannyPay specialist will respond within one business day.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.