How to Safely Accept Credit Card Payments Over the Phone

The safest way to accept a credit card payment over the phone in 2026 is to keep the card number away from your staff. Text or email the customer a secure payment link during the call, or let them pay through an automated phone line. If someone on your team must key in a card, enter it straight into a virtual terminal, run the address and security-code checks, and never write the number down or record the security code.

The best ways to take payments over the phone

Here are today’s options, from safest to least safe:

1. Text or email pay link. You send a secure link while you’re on the call, and the customer pays on a hosted payment page in under a minute. It works for one-time payments, deposits and invoices.

2. Automated pay-by-phone line (IVR). The customer types their card number on their phone’s keypad. It’s ideal for bills with a known amount, like utility or service payments, and it runs around the clock.

3. Virtual terminal. Your staff types the card into a secure web page while the customer reads it out. It needs no hardware and fits customers who won’t use a link.

4. Saved card on file. For repeat customers and autopay, the card stays in your gateway’s secure vault. You keep a token, not the card number.

5. Keying into a countertop terminal. It works, but the number gets read aloud in your store. Use it only as a backup.

The PCI rules for phone payments in 2026

Every business that accepts cards must follow the Payment Card Industry Data Security Standard (PCI DSS). The current version, 4.0.1, has been fully in effect since March 31, 2025. For phone payments, these rules matter most:

• Never store the security code after approval. That includes paper, spreadsheets, software notes and call recordings. Encrypting it doesn’t make it allowed, and neither does the customer’s permission.

• Keep card numbers off paper, out of email and texts, and out of your CRM and order notes.

• Pause or mask call recordings during payment. If a security code is ever recorded, the PCI Council says to delete it right after the sale is approved.

• Use a hosted payment page when you can. With pay links, card data never touches your systems, which makes compliance far simpler.

• Get permission before saving a card. Card brand rules require the customer’s consent. A quick email confirmation works well.

How to prevent phone-order fraud

A phone payment is a card-not-present sale. If a stolen card is used and the cardholder disputes the charge, the business usually takes the loss. A few habits prevent most of it:

• Run AVS (Address Verification Service) and the CVV check on every keyed sale.

• Watch for red flags: rush orders shipping to a different address, several cards tried in a row, or unusually large first orders.

• Ship only to verified addresses, and keep tracking and delivery confirmation.

• Email a receipt for every phone order, and keep the authorization code and AVS and CVV results in case a charge is disputed.

What phone payments cost, and how to lower it

Card-not-present sales carry higher interchange because the risk is higher. On Visa’s current U.S. rates, a typical keyed consumer credit sale costs 1.89% plus $0.10, compared with 1.43% to 1.51% plus $0.10 in store. Mastercard charges 1.95% plus $0.10 for key-entered sales, versus 1.65% plus $0.10 for chip and tap.

You can’t change those rates, but you can avoid paying more than you should:

• Always send AVS. Keyed sales without it can downgrade to a much higher rate.

• Send Level 2/3 data on business orders. It lowers interchange on commercial and government cards.

• Use your industry’s programs. Utilities, for example, can qualify for flat per-transaction rates on phone payments.

• Consider surcharging. A compliant surcharge on credit cards can offset the cost where state law allows.

How Tailored Transactions sets up phone payments

• A free virtual terminal with the ProCharge Gateway, plus text and email pay links through Valor, PayTrace and Dejavoo

• Automated pay-by-phone (IVR) for recurring bills

• A secure card-on-file vault for repeat customers and autopay

• AVS and CVV checks turned on before you go live

• Cost-Plus pricing at Interchange + 0.30% max, with the same markup whether a card is keyed, tapped or entered online

Not sure what your phone payments really cost? Get your free savings analysis and we’ll review your statement line by line and show you exactly what you’d save, within one business day.

Quick answers

Can I write down a card number and run it later? You shouldn’t. A written card number is a security risk, and you can never keep the security code. Enter the card while the customer is on the line, or send a pay link.

Do I need a terminal to take phone payments? No. A virtual terminal and pay links work from any computer, tablet or phone with a web browser.

Can I save a customer’s card for next time? Yes, with their permission, in your gateway’s secure vault. You can save the card, but never the security code.