Taking payment by phone or online: the risk lands on you

A customer calls to confirm an order and reads out their card number. The employee writes it on a scrap of paper, walks to the terminal, keys it in, and throws the paper in the bin. This happens every day in hundreds of businesses, and almost everything about it is a problem.

Taking payment remotely is perfectly legitimate. A caterer taking a deposit, a garage collecting before ordering a part, a professional billing an out-of-town client: all have good reasons. What changes is who carries the risk.

What card-not-present means for you

A transaction is card-not-present when the card isn't physically read by a terminal. That covers online sales, payments taken over the phone, and numbers keyed into a virtual terminal.

The processor and the network can then verify neither a PIN nor a signature. Nobody has confirmed that the person giving the number is the cardholder. That is why these transactions generally cost more to process, and above all why, in a fraud dispute, it is the merchant who ends up defending the file.

An authorization is not proof of identity. A transaction can be approved by the bank and disputed three weeks later.

The non-negotiable rule: the number gets written nowhere

The PCI Security Standards Council, the body that publishes the card industry's security standards, is blunt about this in its guide for small merchants. A card number does not go on paper, does not go in an order book, does not travel by email or text message, and is not kept in a file.

The right way is the most direct one: the number goes from the customer straight to the entry screen, with no stop in between. If you take payment by phone, open the virtual terminal before the call and type while the customer is speaking. If a customer emails you a number, call them, take the payment, then delete the message.

What you can keep is what proves the transaction: the date, what was sold, the amount, the customer's name, the authorization obtained. Never the full number.

What to ask for, and why

Since you can't see the card, ask for the details only the cardholder should know. The verification code printed on the back of the card, first. Then the postal code or billing address, where your system can validate them.

For deliveries, ship to the billing address when you can. An order paid on one card and delivered somewhere else isn't necessarily fraudulent, but it earns one extra check.

For a recurring charge, a deposit or a booking retainer, get written authorization from the customer: what they are authorizing, for how much, how often, and how they can end it. A confirmation email is enough, and it is worth a great deal on the day the customer disputes.

Signals that should make you slow down

None of these proves fraud on its own. Two or three of them in the same order justify a verification call before anything ships.

• An order far larger than your average, from a customer you don't know.
• Insistence on the fastest possible delivery, with no regard for the cost.
• Several cards offered one after another because the previous one was declined.
• A request to split the payment across several different cards.
• A customer who won't give a reachable phone number, or who pressures the employee instead of answering.

Give your staff explicit permission to slow down. A lot of fraud succeeds because an employee doesn't dare keep an impatient customer waiting.

Limit who can take payment remotely

A virtual terminal lets you take a payment from a browser, with no device at all. That is convenient, and it is also the quietest entry point for internal misuse or for anyone who gets hold of a password.

Open the user list in your dashboard and check who has access to that function. Remove former employees, remove shared accounts, and grant access only to the people whose job genuinely requires it.

Do that check this week, then put a reminder in your calendar six months out. It takes five minutes, and it is the kind of list that grows on its own.