Someone’s on the phone wanting to pay. To take card payments over the phone in the UK, you need something called MOTO (mail order / telephone order), and it usually runs through a virtual terminal in your browser. It’s the opposite of tapping a card on your handset, and mixing the two up costs people money. Here’s how it works, what it really costs, and why a payment link is often the better answer.

Tap to Pay is the opposite of this

Get this straight first. It’s where most of the confusion lives. Tap to Pay on a phone, sometimes called SoftPOS, is a card-present payment: the customer is stood in front of you and taps their card or their watch on your handset. If the card later turns out to be stolen, who carries the loss depends on scheme rules, so ask your provider.

Phone payments are the mirror image. The card is somewhere else, in someone else’s hand, and you’re typing numbers they’ve read out to you. No chip, no PIN, nobody to look in the eye. The industry calls this card-not-present, and every difference in price and risk comes out of those three words.

So if what you want is a tap on your own phone with the customer stood there, that’s a different setup. Tap to Pay on your phone vs a card machine covers it. The rest of this page is about the other kind of payment.

What MOTO and a virtual terminal actually are

MOTO stands for mail order / telephone order. It’s a permission your card provider adds to your merchant account, saying you’re allowed to charge a card the customer hasn’t presented. Without it, keyed payments may be declined. It’s usually something your provider switches on for your account rather than something you buy.

The virtual terminal is the thing you actually use. It’s a web page inside your provider’s dashboard, so it works on a laptop in the office or in a browser on your phone in the van. You log in, type the long number, the expiry, the CVV and the billing address, then press charge. The card is debited while the customer’s still on the line, and the money settles into your bank on your usual timetable.

Some card machines can be put into a keyed mode too, so you can do it on the terminal instead. Same kind of transaction, same risk. Either way the account has to be set up for it first.

Why phone payments cost you more

Some providers price card-not-present transactions higher than card-present ones. UK interchange on consumer debit cards is capped in law at 0.2% for any UK debit card transaction (Article 3 of the Interchange Fee Regulation), with no card-present condition, so any extra usually comes from your provider’s own pricing.

How it shows up varies by provider. Check whether keyed payments carry a different rate, whether they appear as their own line on the statement, and whether the virtual terminal has a monthly fee on top of the transaction rate.

Ask for the keyed rate in writing before you sign anything, and ask whether the virtual terminal carries a charge of its own. If a salesperson can only tell you the card-present rate, you haven’t got a quote. You’ve got half of one. The hidden costs of card machines in the UK runs through the charges that tend to appear in month two rather than month one.

The fraud risk sits with you, not the bank

This is the part that catches people out. On a card-present payment the chip and the PIN do the authenticating, and there’s a liability shift built into the rules: if the card was stolen, the issuer generally carries the loss. On a keyed payment there is no shift. The customer’s bank can pull the money back out of your account weeks later, and you’ll usually pay a chargeback fee on top.

You can’t win that dispute with a phone call you remember clearly. No PIN, no signature, nothing with the cardholder’s name on it. MOTO also sits outside the Strong Customer Authentication checks that apply to online card payments,

So build a couple of habits. Take the billing postcode and house number every time so the address check runs, and always take the CVV. If something feels off (a brand new customer, an unusually big order, a delivery address that doesn’t match the card) then slow down and ring them back on a number you found yourself.

Never write the card number down. Not once.

This is the one hard rule in the whole article. Card details go from the customer’s mouth into the virtual terminal while they’re on the line, and nowhere else. Not on a pad. Not in a spreadsheet you’ll tidy up later, not in a note on your phone, not in an email, never photographed, and not in a message to whoever does the books on Friday.

The CVV is the strictest bit. Under the card scheme rules you’re never allowed to store it after the payment, in any form, encrypted or otherwise. If you record your calls, you have to pause the recording while the details are read out, or the recording itself becomes a stored card number sat on someone’s server.

PCI DSS is the standard covering all this. It’s a contractual requirement from your card provider rather than UK law, but that doesn’t make it optional. Breaching it can mean fines passed down the chain to you, and in bad cases the merchant account gets closed. PCI DSS compliance for small businesses explains what you actually have to do, without the jargon.

Pay by link is usually the better answer

A payment link does the same job with less risk, and your provider may price it differently from a keyed payment, so ask. You generate the link in the same dashboard, text or email it over, and the customer types their own details into your provider’s hosted page. You never see the number. Nothing to write down, nothing to store.

The bigger win can be 3-D Secure. If your provider’s payment page asks the customer to authenticate with their own bank, the payment is treated more like an online one, and the fraud liability can shift to the card issuer. That’s the exact protection a keyed payment doesn’t give you.

It isn’t always practical, mind. Some customers haven’t got a smartphone, and some won’t tap a link that’s arrived by text. Some are on a landline and want it done before they hang up. Sometimes you’re in a signal blackspot on site. And a trade customer who rings the same order in every Thursday won’t thank you for a fresh link each time.

The sensible setup for most people is both. Link first, MOTO for the ones who won’t use it.

Who genuinely needs MOTO

Deposits are one case. A joiner wants money down before ordering the units, and he isn’t driving back across town for it. Same for a holiday let taking the balance six weeks out, or a garage that’s finished a job while the customer’s at work twenty miles away. The alternative is waiting on a bank transfer that may not land before you need to start.

Repeat account customers are the other real case. If the same handful of trade customers ring an order in every week, some providers can hold the card securely as a token on their side, so you’re authorising a payment rather than keying a number. That’s the safe version. What you must never do is keep the number yourself and call it a card on file.

Then there’s the customer who simply will not use a link A payment they can hear you take is the one they trust. Don’t argue with it.

Last one is the backup. If your terminal dies on a Saturday or the broadband drops, having MOTO already switched on means you can still take money from a browser on your phone.

How to get it switched on, and what to check first

Ask your current provider before you assume you’ve already got it. Not every provider offers MOTO on every account, and it may be off by default. It may need an underwriting check: what you sell, roughly what share of your takings will be keyed, and your typical transaction size. Some trades may not be approved.

If the answer is no, or the keyed rate is miles off, that’s a switching conversation rather than an argument. Before you sign with anyone, get these in writing:

• The card-not-present rate as its own figure, separate from the card-present rate they led with.
• Whether the virtual terminal has a monthly fee, and whether pay by link is included or charged on top.
• The chargeback fee, and who does the dispute paperwork when one lands.
• Any cap on keyed payments, such as a share of your monthly turnover.
• The term. Some providers will do this on no long contract, so a three or five-year tie-in for what is essentially a web page isn’t something you have to accept.

That last point matters more than a fraction of a percent on the rate, because it’s the thing that stops you moving when something better turns up. Card machines with no long contract covers who still sells them and what the catch tends to be.

FAQs

Is it legal to take card payments over the phone in the UK?

Yes. Your provider has to enable MOTO on your account first, and the card scheme rules govern how you handle the details, which is a contract with your provider (data protection law applies to card details too).

Can I just key the number into my existing card machine?

Sometimes. Some terminals have a keyed entry mode, but it has to be enabled on the merchant account behind it, and keyed payments may be charged at a different rate. Other providers block it. Ring and ask rather than finding out on a declined payment.

Is it safe to take card details over the phone?

Safe enough if you key them straight in while the customer’s on the line and write nothing down. The risk you can’t design away is fraud. The payment can be reversed weeks later and you carry it, which is why a link is the better default where the customer will use one.

Do I need a card machine at all?

No. A virtual terminal is a web page, so if nearly all your work is quoted and paid remotely you may never need hardware.

How long does it take to get MOTO added?

It depends on the provider and your trade, so ask your provider for a timescale. Sort it before your busy season, not during.