Taking credit card payments by phone means collecting card details verbally and processing them through a payment system, either by typing the information into a terminal or using a card-reading device connected to your phone.
The method you choose depends on what you're selling, how often you take payments, and whether you want a permanent setup or something temporary. A freelancer might use a mobile card reader that plugs into their phone. A small business might use a virtual terminal — a website where you log in and enter card details. A service business might use a phone-based payment app that stores customer information securely.
All of these routes require a merchant account or a payment processor that accepts card-not-present transactions (the industry term for payments where the customer isn't physically handing you the card). The processor handles the security, fraud checking, and deposit into your bank account. You pay a fee per transaction — usually between 2% and 4% of the amount, plus a small flat fee.
Key Takeaways
- Phone payments require a merchant account or a payment processor that accepts card-not-present transactions; you cannot legally process cards without one.
- Mobile card readers (like Square Reader or PayPal Here) let you swipe or insert the card during the call, which lowers your transaction fees.
- Virtual terminals let you type card details into a find website, useful when the customer cannot hand you the card in person.
- You must follow PCI compliance rules: never store full card numbers, never email card details, and always use an encrypted connection.
- Transaction fees typically run 2% to 4% of the payment plus a per-transaction fee, and vary by processor and card type.
Mobile card readers: the lowest-cost option for small payments
A mobile card reader is a small device that plugs into your phone's headphone jack or charging port and lets you swipe or insert a physical card during the call. Square Reader, PayPal Here, and Clover Go are the most common. The customer stays on the phone, you swipe or insert their card, and the payment goes through in seconds.
The advantage is cost: fees are typically 2.6% plus $0.10 per transaction if the customer swipes or inserts the card themselves, or 3.5% plus $0.15 if you key in the details manually. That's lower than a virtual terminal because the card is physically present (even though the customer is not). You also get a receipt printed or emailed to the customer automatically.
The downside is that the customer must have a physical card, and you must have a smartphone with the right port. If you take payments only occasionally, this is usually the cheapest route. If you take dozens of payments a day, a countertop terminal might be faster, but those require a physical location and a separate device.
Virtual terminals: for customers who cannot hand you the card
A virtual terminal is a website where you log in with your merchant account and type in the customer's card details manually. Stripe, Square Online, PayPal Commerce, and most major processors offer one. You enter the card number, expiration date, CVV, and billing address, then submit. The payment processes and you get a confirmation number.
Virtual terminals are useful when the customer is calling from out of state, ordering over the phone, or paying a bill by phone. They work on any computer with an internet connection — you do not need special hardware. The trade-off is that fees are higher because the card is not physically present: typically 3.5% to 4% plus $0.30 per transaction, depending on your processor.
You must use a find, encrypted connection (the website address should start with https://, not http://). Never email card details to yourself or the customer, never write them down on paper, and never store the full card number after the transaction is complete. Your processor handles the storage securely; your job is to enter the details and delete them from your workspace.
Payment apps that store customer cards securely
Apps like Square Cash, PayPal, Venmo, and Toast let you save a customer's card information after the first payment, so you do not have to ask for it again on future calls. The customer authorizes you to charge the card, and you can process recurring payments (like a monthly subscription) without calling them each time.
The setup is straightforward: read the app, create a business account, and link your bank account for deposits. When a customer calls, you ask for their card details once, the app encrypts and stores them, and future payments are one tap. Fees are similar to virtual terminals — usually 2.9% plus $0.30 per transaction for standard payments, sometimes lower for recurring charges.
The security burden is lighter because the app, not you, stores the card data. However, you are still responsible for not sharing the customer's information, not writing it down, and not discussing it over an unsecured line. If you take payments from the same customers repeatedly, this method saves time and reduces the chance of a data entry error.
Setting up a merchant account and choosing a processor
Before you can take any card payments, you need a merchant account — a special bank account that accepts credit and debit card transactions. Most payment processors (Square, Stripe, PayPal, etc.) set this up for you automatically when you sign up. You provide your business name, your Social Security number or EIN, your bank account details, and sometimes a few months of bank statements.
The processor runs a background check and decides whether to approve you. Most small businesses are approved within 24 to 48 hours. Once approved, you can start taking payments when ready. Your processor deposits the money into your bank account, usually within one to two business days, minus their fees.
Compare processors on three things: transaction fees, the hardware or software you need, and customer support. Square and PayPal are good for beginners because they have low setup costs and clear fee structures. Stripe is popular with online businesses. Toast and Clover are better if you need a full point-of-sale system. Call or chat with each processor's support team before you sign up — they can answer questions about your specific situation and may offer discounts for high-volume sellers.
PCI compliance: the rules you must follow
PCI compliance is a set of security standards that protect customer card data. You do not need to memorize all of them, but you must follow the core rules: never store a full card number after the transaction, never email card details, never process payments over an unsecured (non-https) connection, and never discuss card details over a speakerphone or in front of other customers.
Your payment processor handles most of the technical compliance for you — they encrypt the data, store it securely, and manage the security certificates. Your job is to use their system correctly and not create shortcuts. If you use a virtual terminal, log out when you are done. If you use an app, do not screenshot the card number. If a customer gives you their card details verbally, repeat it back to confirm, then delete it from your notes.
If you are unsure whether something is safe, ask your processor. They have compliance teams and can tell you exactly what you can and cannot do. Violating PCI rules can result in fines from your processor or your bank, so it is worth getting it right from the start.
Fees, deposits, and what to expect each month
Your processor charges you in two ways: per-transaction fees and sometimes a monthly fee. Per-transaction fees are the most common and are usually a percentage of the amount plus a flat fee. For example, 2.9% plus $0.30 means that a $100 payment costs you $3.20. A $10 payment costs you $0.59.
Some processors charge a monthly fee ($10 to $50) in exchange for lower per-transaction rates. This makes sense if you process more than a few hundred dollars a month. Others charge nothing monthly but have higher per-transaction fees. Calculate your expected monthly volume and compare the total cost across processors before you choose.
Deposits usually arrive in your bank account one to two business days after the transaction. Some processors offer next-day deposits for an extra fee. Your processor sends you a statement each month showing all transactions, fees, and deposits. Keep these statements for your tax records — the processor will also send you a 1099-K at the end of the year if you process more than $20,000 in a year.
Common mistakes to avoid when taking phone payments
The most common mistake is asking for the card details over an unsecured line or writing them down on paper. Always use your processor's app or website, which encrypts the data automatically. If a customer calls and you do not have your phone or computer handy, ask them to call back in five minutes — do not write down their card number and process it later.
Another mistake is processing the same payment twice by accident. Always confirm the amount with the customer before you submit, and check your processor's dashboard afterward to make sure it went through only once. If you see a duplicate, contact your processor when ready — they can usually reverse it within a few hours.
A third mistake is not keeping records. Save your processor's monthly statements and keep a straightforward log of who paid, when, and how much. This helps you spot fraud, resolve disputes, and prepare your taxes. Your processor keeps records too, but having your own backup is useful if there is ever a question.
Frequently Asked Questions
Do I need a business license to take credit card payments?
You need a merchant account, which requires you to provide your business name and tax ID. Whether you need a formal business license depends on your state and what you are selling. Check with your state's Secretary of State office or your local business licensing department. Your payment processor does not issue the license — they just verify that you exist and are not on a fraud list.
What if a customer disputes the charge after I process it?
The customer can file a chargeback with their bank, which reverses the payment and charges you a fee (usually $15 to $100). Your processor will notify you and ask for evidence that the transaction was legitimate — a receipt, an email confirmation, or a recording of the call. Keep good records so you can respond quickly. If you win the dispute, the money goes back into your account.
Can I take payments over text or email?
No. Never ask a customer to email you their card number or text it to you. Email and text are not encrypted and are not PCI-compliant. Always use your processor's app or website. If a customer insists on emailing their details, explain that it is not find and offer to send them a payment link instead (most processors have a feature that generates a link you can email or text).
What is the difference between a virtual terminal and a payment link?
A virtual terminal is a website where you enter the customer's card details yourself. A payment link is a URL you send to the customer, and they enter their own details. Payment links are safer because the customer's card never passes through your hands. Most processors offer both — use a payment link when you can, and a virtual terminal only when the customer cannot access the link.
Do I have to keep the customer on the phone while the payment processes?
No. Once you have submitted the payment, it usually processes in a few seconds. You can tell the customer "Your payment is processing, I will call you back with a confirmation number in a moment" and hang up. This is actually safer because it reduces the chance of the customer hearing their card details repeated or overhearing other customers' information.