How to Take Credit Card Payments Over the Phone Safely

On this page 7 sections

1. How to Take Credit Card Payments Over the Phone: Choosing Your Tools
2. What Information to Collect for the Best Rate
3. Why Keyed Transactions Cost More
4. Phone Payment PCI Compliance: Rules for Handling Card Data
5. Reducing Fraud on MOTO Payments
6. Sending Receipts and Keeping Records
7. Next Steps for Setting up Phone Payments

Key takeaways

• A virtual terminal or payment link lets staff take phone payments without writing card numbers down or storing them.
• Collecting the billing ZIP code or address, the security code and accurate order details helps keyed transactions qualify for better pricing and resist fraud.
• Phone payment PCI compliance depends on habits: enter card data directly, never store the security code, and keep card numbers out of notes, emails and call recordings.
• Itemized receipts, signed authorizations and call notes are your best evidence when a phone payment is disputed.

Knowing how to take credit card payments over the phone keeps cash moving for service businesses. A client might call to pay a retainer, a homeowner might approve a repair deposit, or a patient might settle a balance after insurance pays. This guide covers which tools to use, what information to collect so keyed transactions price as well as they can, how to handle card data so staff never write a number down, and how to cut fraud and chargeback risk.

Phone orders are a type of card-not-present transaction, often called MOTO payments (mail order/telephone order). They follow different pricing and fraud rules than a card tapped or inserted at a terminal. For the fuller picture, see our breakdown of card-present vs. card-not-present fees, fraud, and rules.

How to Take Credit Card Payments Over the Phone: Choosing Your Tools

You have three practical options. Many businesses use more than one.

Virtual Terminal

A virtual terminal is a secure, browser-based payment screen. Staff type the card details from the caller directly into it, and nothing needs to be written down first. It is the most common tool for phone payments because it runs on an office computer, records the transaction in your gateway, and can usually send an email receipt right away. If you're new to the concept, start with what a virtual terminal is and how it works. MannyPay offers virtual terminals for phone and mail orders along with gateway options such as Authorize.net and NMI.

Payment Links and Online Invoices

With a payment link, you send the customer a secure checkout page by email or text, and they enter their own card details. Your staff never hear or see the card number, which removes much of the handling risk. Payment links suit larger or first-time payments, such as a contractor deposit or a professional services retainer. Ask your provider whether your gateway supports hosted invoices or payment pages. MannyPay's expanding merchant platform is designed to include text-to-pay and payment links.

Keying Into a Card Terminal

Many countertop and smart terminals allow manual card entry. This works in a pinch. But it means a staff member is often holding a phone in one hand and keying with the other at a shared counter, which makes it easier for others to overhear or see the number. If phone payments are routine, a virtual terminal is usually the cleaner setup. For a step-by-step walkthrough, see our guide on how to accept credit card payments over the phone.

What Information to Collect for the Best Rate

Card networks price transactions partly on how much verification and order data comes with them. Missing fields can push a keyed transaction into a more expensive category, sometimes called a downgrade. Collect these every time:

• Card number and expiration date, entered directly into the system.
• Security code (CVV2, CVC2 or CID), used for authorization only and never stored.
• Billing ZIP code or full billing street address, used for Address Verification Service (AVS) checks.
• Cardholder name as it appears on the card.
• Invoice or order number, so the charge matches your records.
• Sales tax amount and customer reference or PO number for business and purchasing cards. Many B2B clients of accountants, contractors and plumbers pay with commercial cards, and sending this extra data (often called Level 2 or Level 3 data) may qualify for better interchange where your gateway supports it.

Also confirm the transaction is flagged as a phone order in your system. A virtual terminal normally handles this automatically. Ask your provider to confirm your settings.

Why Keyed Transactions Cost More

When a card is tapped or inserted, the chip verifies that a real card is present. On a phone call you can't verify that, so issuers carry more fraud risk and card networks charge higher interchange for keyed transactions. Card-not-present payments also tend to see more disputes, and that risk is reflected in pricing. For the mechanics, read why online and keyed transactions cost more to process.

You can narrow the gap in a few ways:

• Send complete AVS and security code data on every keyed transaction.
• Settle batches daily. Delayed settlement can affect qualification.
• For repeat in-person customers, take the card on a terminal when they're on site rather than keying it later.
• Review your pricing model, because keyed costs show up differently under interchange-plus, flat-rate and tiered plans.

Some businesses offset card costs with a cost program. MannyPay offers cash discount, dual pricing, surcharging where permitted, and zero cost processing programs. Each has disclosure rules, and surcharging rules vary by card brand and state. Review the Visa and Mastercard surcharge rules and confirm current terms before adding a fee to phone payments.

Phone Payment PCI Compliance: Rules for Handling Card Data

PCI DSS is the security standard every business that accepts cards must follow. Phone payment PCI compliance mostly comes down to daily habits. The core rule is simple: card data goes from the caller's mouth straight into a secure system and nowhere else.

Never do this:

• Write card numbers on sticky notes, notepads, intake forms or job tickets.
• Store the security code anywhere after authorization. PCI DSS does not allow it, even in encrypted form.
• Type card numbers into email, text messages, chat tools, spreadsheets, CRM notes or practice management notes.
• Read the full card number back aloud where others can hear.
• Take payments on personal phones or home computers that your business doesn't control.

Do this instead:

• Give each staff member a unique login to the virtual terminal. Remove access the day someone leaves.
• Take phone payments in a private area with the screen facing away from customers and visitors.
• If you record calls, check whether card details end up in recordings. Recordings that capture card numbers become part of your PCI scope. Pause recording during payment, or ask your provider about solutions that keep card data out of recordings.
• Complete your annual PCI self-assessment. Your processor can tell you which questionnaire applies to your setup.

A Simple Script for Staff

1. "I can take that payment now. Is the card in your name?"
2. Enter the card number directly into the virtual terminal as the caller reads it.
3. Ask for the expiration date, security code and billing ZIP code.
4. Confirm the amount and what it covers, such as "deposit for the kitchen remodel" or "balance from the March 4 visit."
5. Submit, read back only the last four digits and the approval, and confirm the email for the receipt.

Medical and dental offices: card data and protected health information are separate compliance areas. Keep card numbers out of patient charts and notes. Confirm your obligations with a qualified compliance professional.

Reducing Fraud on MOTO Payments

Fraudsters favor phone orders because they never have to show a card. Watch for these red flags:

• A first-time caller who wants a large job or service paid immediately and "doesn't care" about the price.
• Requests to split one payment across several cards after the first one declines.
• AVS or security code mismatches. Treat them as a reason to stop, not to retry.
• Requests to refund an "overpayment" to a different card, or by wire or gift card.
• A cardholder name that doesn't match the client, patient or property owner, with no clear explanation.

Practical defenses by industry:

• Contractors: For large deposits, send a payment link tied to a signed estimate, and get written authorization. Our guide on contractor deposit disputes covers the documentation that holds up.
• Plumbing and home services: After-hours callers are often stressed and legitimate. Still, verify the service address and the cardholder before dispatch. See how to handle collecting after-hours fees upfront on emergency calls.
• Medical and dental: A spouse or parent often pays by phone. Record the cardholder's name and relationship and confirm the authorization in writing.
• Professional services: Firms that hold client funds should confirm which account a card payment belongs in before charging. Our article on flat fees and which account gets the card payment explains the issue. Confirm the specifics with your state bar or accounting regulator.

If you move a caller to an online checkout through a payment link, ask whether 3-D Secure authentication is available on that checkout for extra cardholder verification.

Sending Receipts and Keeping Records

Good records prevent disputes and win the ones that happen anyway.

• Send an itemized email receipt immediately. Include your business name as it appears on statements, a phone number, the date, the amount, what was purchased and the last four digits of the card.
• Use a clear billing descriptor. Customers who don't recognize a charge often dispute it.
• Get written authorization for cards kept on file. For recurring or future charges, have the customer sign or electronically accept the terms first. Practices billing after insurance can follow our guide to card on file for patient balances.
• Log the call. Note the date, time, staff member, caller name and what was authorized. Leave out card numbers.
• Sync payments to your books. MannyPay integrates with tools like QuickBooks for payment reconciliation, which keeps invoices and payments matched.
• Keep records in an organized way for as long as your processor and accountant advise.

If a dispute arrives, these records become your evidence. Our chargeback rebuttal letter template shows how to present them.

Next Steps for Setting up Phone Payments

1. Choose a primary tool. For most offices that's a virtual terminal, with payment links for large or first-time payments.
2. Turn on AVS and security code checks, and confirm phone orders are flagged correctly.
3. Train staff on the script and the "never write it down" rule, then audit desks and notes for stray card numbers.
4. Review your statement to see what keyed transactions cost you, and whether a compliant cost program fits.

If you'd like help setting this up, request a free quote from MannyPay. A MannyPay specialist responds within one business day to review your phone payment workflow and processing options.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.