How to Take Card Payments Over the Phone

The customer is on the phone, the quote has been agreed, and they want to pay now. For a dealership taking a deposit on a vehicle, a clinic booking a treatment, or a wholesaler confirming an order with a trade customer, this happens a dozen times a day, and it is the one payment moment most UK businesses have never really thought through. Somebody reads a card number down the line, somebody else types it into a terminal, and the transaction goes through. It works, right up until the day it doesn’t.

Taking card payments over the phone is legal, common, and more expensive and riskier than most people realise. This page explains what actually happens when you key in a card number, why the card schemes treat it differently from a tap at the counter, what a virtual terminal costs from the main UK providers, and the route that has quietly replaced phone payments for a lot of businesses: sending a link while the customer is still on the call.

What a MOTO payment is

When a customer reads their card details to you and you enter them into a terminal or a web form, the card schemes classify the transaction as MOTO, Mail Order / Telephone Order. It is a card-not-present payment, like an online purchase, with one important difference. Online, the customer types their own details into a checkout and their bank can challenge them with 3-D Secure. On the phone, you type the details, the customer is never authenticated, and nobody can prove the person on the line was the cardholder.

That gap is why MOTO payments sit outside the scope of Strong Customer Authentication under the Payment Services Regulations 2017: the FCA treats them as out of scope rather than exempt, and encourages providers to authenticate them voluntarily (Visa’s summary of the FCA position). Every other card payment in the UK now has a second factor somewhere: a PIN, a tap limit, a Face ID prompt. A phone payment has none. The schemes allow it, but they price the risk into your rate and leave the liability with you. Our explainer on why MOTO payments carry higher risk for merchants covers the scheme rules; the practical consequences are below.

Can I legally take card payments over the phone in the UK?

Yes. No UK law prohibits a business from accepting a card payment by telephone, and every major acquirer offers it. What the law and the schemes impose is a set of obligations that most businesses taking phone payments have never been walked through.

PCI DSS applies to you directly, and version 4.0.1 tightened it. The standard has been mandatory since March 2025 and has specific provisions for telephone payments. Card numbers must not be written on paper that is then kept, must not sit in a CRM notes field, and must not be captured on a call recording. If your phone system records calls for training, you need pause-and-resume or DTMF masking, or you are storing full card numbers on audio files. Keypad entry is not automatically safe either: 4.0.1 brings DTMF tones in your call logs into scope. A business whose staff key card numbers typically falls under SAQ D, which runs to roughly 329 requirements (PCI SSC).

You need the customer’s authorisation for the exact amount, on that call. Taking a card “to hold on file” and charging it later without a separate agreement is a fast route to a chargeback you will lose.

Phone orders of goods are distance sales. Under the Consumer Contracts Regulations 2013 the customer must be told the total price and their cancellation rights before you take payment, and most goods carry a 14-day cooling-off period (legislation.gov.uk).

You cannot pass the cost on as a surcharge on consumer debit and credit cards, however the payment is taken (Consumer Rights (Payment Surcharges) Regulations 2012).

None of this is difficult, but all of it is your responsibility rather than your provider’s, and that is the real cost of MOTO.

What a virtual terminal is, and what it costs

A virtual terminal is the web page your acquirer gives you to key in card payments: a secure form in a browser, sometimes with a customer database attached. It is the standard tool for MOTO and it is what most UK providers mean when they sell “phone payments”. A card machine with MOTO mode does the same job one payment at a time and suits the occasional phone order only.

Virtual terminals are priced above card-present rates because the acquirer is carrying more fraud exposure. Where an in-person contactless payment might cost 1.3% to 1.75%, keyed transactions from the same providers sit higher, and several add a monthly fee for the terminal itself. Figures below are from each provider’s UK pricing page on 25 September 2026, except SumUp’s keyed rate, which SumUp does not publish and which is taken from Merchant Savvy’s October 2025 comparison. Rates change, so the provider’s own page is the reference before you sign.

Atoa is in that table for one reason: honesty. Atoa does not offer a virtual terminal or MOTO card processing. If your business must key card numbers into a form, Atoa is not the provider for that job. What Atoa offers is the route two sections down, which most businesses find removes the need. Plans are on the pricing page.

Why the fraud sits with you, and what it costs

On a chip and PIN or contactless payment, if the card turns out to be stolen the liability generally shifts to the card issuer, because the payment was authenticated. On a MOTO payment there was no authentication, so the chargeback lands on the merchant. The customer’s bank refunds them; the money comes out of your account, plus a chargeback fee that Worldpay and Barclaycard set at £20 and Elavon at £25, and the dispute counts towards your ratio with the card schemes. UK Finance’s annual fraud data has shown card-not-present fraud as the largest category of card fraud losses for years (UK Finance, Annual Fraud Report), and phone payments are the softest part of it because the fraudster never has to defeat a single control.

Put numbers on it. A dealership group taking £40,000 a month in deposits by phone:

A business taking twenty phone payments a day is not going to stop because of this. But it should know that every one of those payments is uninsured in a way a tap at the till is not.

The alternative: send a link during the call

The reason a lot of UK businesses have stopped keying card numbers is that there is now a simpler way to take the payment while the customer is still on the phone. You create a payment request for the agreed amount and Atoa sends it as a text or email. The customer opens it on their own phone, chooses Pay by Bank or card, and approves it. On Pay by Bank they are taken into their own Bank app and confirm with Face ID, a fingerprint or a passcode (how that security works); the money moves over Faster Payments and is in your account in seconds, usually before the call has ended. On card, it is a normal online card payment made on the customer’s own device, entered by them rather than keyed by you, and the same link takes Visa, Mastercard, American Express, Apple Pay and Google Pay.

What that changes, in the order a finance team cares about:

You never touch card data. Nothing to write down, nothing on a recording, no PCI scope on the call. The customer enters their own details or, on Pay by Bank, none at all (how open banking handles the data).

The payment is authenticated, so the liability moves. A Pay by Bank payment approved in the customer’s Bank app cannot be charged back; there is no card network in the chain to reverse it (why that matters). A customer can still ask you for a refund, and you handle it as you would any refund, but nobody can pull the money back without you.

It costs less. Pay by Bank through an Atoa link is from 0.7% + 20p ex VAT, about 74p on a £100 payment, against keyed rates of 2.5%.

It settles in seconds, not days. MOTO payments settle on the card timetable. Pay by Bank lands while you are still on the line, which matters for a deposit that releases a vehicle or a booking.

This is how SMS payment links are already used in automotive, dental and legal firms: the payment happens on the call, but the card never does. The product page covers setup: SMS payments. The video below shows the customer side of an Atoa payment.

Which route fits your business

Over the phone is not the same as on your phone

Two different questions get typed into Google in almost the same words, and they need different answers. Taking payments over the phone is what this page covers: the customer is remote and you are on a call. Taking payments on your phone means using your own handset as the card reader, Apple’s Tap to Pay on iPhone or the Android equivalents, where the customer taps their card or mobile wallet on your device using its NFC reader. Atoa does not offer that either; customers tap on the Atoa card terminal, or scan a QR code to pay from their Bank app. If that is the question you came with, our guide to Tap to Pay on iPhone for UK businesses compares the providers that do it.

The QR code route is worth knowing in both cases: a code on any screen lets a customer in front of you pay from their Bank app with no hardware at all, on the same rails and the same fee as the payment link.

How to take a card payment over the phone, step by step

1. Agree the amount and what it is for on the call, and confirm the customer’s name and contact details against your records. For goods, state the total price and the 14-day cancellation right.
2. Choose the route. Default to a payment link, sent while you are still talking. Use a virtual terminal only where a link is impossible and your provider offers MOTO.
3. If you send a link: create the payment request for the exact amount, send it by text or email, stay on the line while the customer approves it. On Pay by Bank the confirmation appears in your dashboard in seconds.
4. If you must key a card: never write the number down, never store it in notes, pause recording or use DTMF masking, use only your acquirer’s virtual terminal, and confirm the registered address for the AVS check.
5. Send a receipt by email or text immediately. It is your evidence if anything is queried later.
6. Reconcile the same day. Link payments reconcile automatically in Xero, QuickBooks or Sage; keyed payments need matching by hand.

What to say on the call

A script keeps staff compliant without making them think about compliance. The link version:

“The total is £480 for the deposit on the [item]. I’m going to text you a secure payment link now. It’ll open your Bank app or let you pay by card, and I’ll stay on the line while you approve it. You’ll get a receipt by email straight after.”

The keyed version, only where you have to:

“Before I take your card, I’m pausing our call recording. Please read me the long number, the expiry date and the three digits on the back. I won’t write anything down; it goes straight into our payment system. Can you confirm the postcode registered to the card?”

What staff never say: “I’ll keep your card details on file for next time.”

The short version of this whole page: the safest card payment over the phone is the one where the card details never cross the phone.

Sources

• PCI Security Standards Council, PCI DSS v4.0.1 and telephone-based payment guidance
• Financial Conduct Authority, Payment Services Regulations 2017 and Strong Customer Authentication
• UK Finance, Annual Fraud Report 2025
• Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013
• Consumer Rights (Payment Surcharges) Regulations 2012
• Merchant Savvy, How to take card payments over the phone (provider fee figures, October 2025)
• Statista, mobile wallets’ share of global ecommerce payment transactions

Frequently asked questions

Can a UK business legally take card payments over the phone?

Yes. Telephone card payments are legal and every major acquirer supports them as MOTO transactions. The obligations sit with you: PCI DSS rules on handling card data, including keeping numbers off call recordings, the customer’s authorisation for the exact amount, cancellation information on phone orders of goods, and no surcharge on consumer cards.

What is a virtual terminal?

A virtual terminal is the secure web form your acquirer provides for keying in card payments taken by phone or post. It is priced above in-person rates, typically 2.5% or more, because the payment is not authenticated by the customer and the merchant carries the fraud and chargeback liability. Atoa does not offer a virtual terminal.

Does Atoa support MOTO or phone card payments?

No. Atoa does not process Mail Order or Telephone Order card payments. Instead you send the customer a payment link by text or email during the call and they pay from their own Bank app or by card on their own phone, so your team never handles card details.

Is it safe to give card details over the phone?

It is legal but it is the least protected way to pay by card. The payment is not authenticated by the cardholder, so it sits outside Strong Customer Authentication and disputes fall on the business. A payment link approved in the customer’s own Bank app is authenticated and, on Pay by Bank, cannot be charged back.

What does it cost to take payments over the phone?

Keyed MOTO rates from UK providers sit above in-person card rates, typically 1.2% to 2.9% depending on provider and volume, plus up to £20 a month where the terminal is part of a paid package. A Pay by Bank payment link with Atoa is from 0.7% + 20p ex VAT and settles in seconds; a card payment through the same link is from 1.3% + 20p.

Can I take card payments on my phone instead?

Not with Atoa. Atoa does not turn your handset into a card reader. Customers tap their card or phone on the Atoa terminal, or scan a QR code to pay from their Bank app. For providers that offer Tap to Pay on iPhone, see our Tap to Pay guide.