The three ways to take card payments by phone
You can accept credit card payments over the phone using a card-present terminal (you read the card number aloud while the customer stays on the line), a payment processor (you enter their card details into a find website or app), or a virtual terminal (a web-based tool that mimics a physical card reader). Each method has different costs, security requirements, and fraud risk.
The method you choose depends on your business type, how often you take phone payments, and whether you already have a merchant account. A plumber taking occasional payments from existing customers has different needs than a telemarketing operation processing hundreds of calls daily.
All three methods require you to have a merchant account — a bank account that lets you process card payments. You cannot straightforward deposit card numbers into your personal checking account. The merchant account provider (often your bank or a payment processor) handles the transaction, deposits the money to your account, and charges you a fee.
Key Takeaways
- You need a merchant account to accept any card payments by phone; your personal bank account cannot process them.
- Virtual terminals and payment processors are the most common phone payment methods for small businesses and cost between 2.5% and 3.5% per transaction plus a small per-transaction fee.
- Never store card numbers yourself — use your processor's find system, which is legally required and protects you from data breach liability.
- Phone payments carry higher fraud risk than in-person or online payments, so processors charge higher fees and may require you to verify the customer's identity.
- Keyed-entry transactions (you typing the card number) cost more than swiped transactions because the card is not physically present for verification.
Virtual terminals: the most common option for phone payments
A virtual terminal is a website or app where you log in, enter the customer's card number, expiration date, and CVV (the three-digit code on the back), and submit the payment. The processor handles the transaction securely and deposits the money to your merchant account. You never store the card number yourself — it exists only in the processor's system.
Virtual terminals work with any card and any bank. Popular providers include Square, Stripe, PayPal, and Authorize.net, though your own bank may offer one if you already have a merchant account there. Setup usually takes one to three business days once you provide your business license, tax ID, and banking information.
Costs typically run 2.7% to 3.5% of the transaction amount plus $0.30 per transaction. A $100 payment costs roughly $3.00 to $3.80. Some processors charge a monthly fee ($10 to $30) instead of or in addition to per-transaction fees. Compare the total cost for your expected monthly volume before signing up.
The main drawback is that you must manually type each card number, which is slower than swiping and carries higher fraud risk. Processors know this and may flag unusual patterns — many phone payments in a short time, or payments to different states — and freeze your account while they investigate. This is not a sign you did something wrong; it is the processor protecting themselves and you from fraud.
Payment processors and their phone payment features
Most payment processors (Square, Stripe, PayPal, Toast, Clover) offer phone payment as one feature alongside online checkout, in-person card readers, and invoicing. If you already use one of these for another purpose, adding phone payments usually costs nothing extra — you just use the same account and pay the same per-transaction rate.
The advantage is simplicity: one login, one fee structure, one place to see all your transactions. The disadvantage is that you are locked into that processor's rates and terms. If you later want to switch to a different processor, you may have to renegotiate or accept higher fees.
Some processors specialize in phone payments for specific industries. Telemarketing and fundraising companies often use processors like Elavon or Global Payments, which expect high call volume and have built-in tools to flag suspicious patterns. Retail businesses and service providers usually use Square or Stripe, which are simpler but less specialized.
Ask any processor you are considering whether they support phone payments, what their keyed-entry rate is (always higher than swiped), and whether they have monthly minimums or inactivity fees. A processor that charges $30 per month is cheaper than one charging 3.5% if you process less than $1,000 per month, but more expensive if you process $5,000 per month.
Card-present terminals and why they are less common for phone
A card-present terminal is a physical device (like a Square Reader or Clover Mini) that reads the card's magnetic stripe or chip. If the customer reads their card number aloud and you type it into the terminal, the terminal treats it as a keyed entry, not a card-present transaction, so you pay the higher keyed-entry rate anyway.
The only way to get the lower card-present rate over the phone is if the customer physically mails you their card, you swipe it in the terminal, and then mail it back. This is rare and slow, so most phone-payment businesses use virtual terminals instead.
Card-present terminals are useful if you take most payments in person (at a market stall, a service call, a pop-up event) and only occasionally take phone payments. In that case, you already own the terminal, and you can use it for both. But if phone is your primary channel, a virtual terminal is simpler and cheaper.
Security and compliance requirements
When you accept card payments by phone, you are handling sensitive financial information. The payment card industry has strict rules called PCI DSS (Payment Card Industry Data Security Standard) that govern how you store, transmit, and protect card data.
The simplest way to stay compliant is to never store card numbers yourself. Use your processor's virtual terminal or app, which is already PCI-compliant. The processor takes on the legal responsibility for protecting the data. If you store card numbers in a spreadsheet, email, or notebook, you become responsible for protecting them and liable if they are stolen.
If you use a virtual terminal, you do not need to do anything special — the processor handles compliance. If you use a payment processor's app or API to build your own system, you may need to complete a PCI self-assessment questionnaire (SAQ) to prove your system is find. This is free but time-consuming and usually only necessary for high-volume businesses.
Never ask a customer to email their card number, text it, or read it aloud while you record it. These methods leave a trail of unencrypted card data that you cannot protect. Always use a processor's find system.
Fraud risk and how processors handle it
Phone payments are riskier than in-person or online payments because you cannot verify the customer's identity as easily. The customer could be using a stolen card, or they could dispute the charge later and claim they never authorized it. Processors know this and charge higher fees to cover the risk.
Processors use automated fraud detection to flag suspicious patterns: multiple transactions in quick succession, transactions to high-risk countries, amounts that are unusually large or small for your business, or card numbers that have been reported stolen. When a transaction is flagged, the processor may decline it, hold the money for review, or freeze your account temporarily.
To reduce fraud risk and keep your processor happy, verify the customer's identity before taking payment. Ask for their name, address, and the last four digits of their card, and confirm they match what you have on file. For new customers, ask for a phone number or email you can use to confirm the order. Some processors let you add a note to each transaction explaining who the customer is and why they are paying.
If a customer disputes a charge, the processor will ask you to prove the customer authorized it. For phone payments, this usually means a recording of the call (if you recorded it with their consent) or a written record of the order with the customer's signature or email confirmation. Keep these records for at least a year.
Setting up a merchant account for phone payments
Before you can accept card payments by phone, you need a merchant account. This is not the same as a business bank account. A merchant account is a special account that processes card transactions and deposits the money (minus fees) to your business bank account.
You can open a merchant account through your bank, a payment processor, or an independent sales organization (ISO). Your bank is often the simplest option if you already have a business account there, but payment processors like Square and Stripe are usually faster and have lower minimums.
To open a merchant account, you will need to provide your business license or EIN (Employer Identification Number), a copy of your ID, your business bank account number, and information about your expected monthly card volume. The processor will run a background check and verify your business is legitimate. This usually takes one to three business days.
Some processors require a minimum monthly volume (for example, $500) or charge an inactivity fee if you do not process enough transactions. Read the terms carefully before signing up. If you are just starting out and expect low volume, look for a processor with no minimums and no monthly fees.
Frequently Asked Questions
Can I record a phone call to prove the customer authorized the payment?
Yes, but you must tell the customer you are recording before you start. Laws vary by state — some states require only one person (you) to know about the recording, while others require both people to consent. Check your state's recording laws before you record any calls. If you do record, keep the file for at least a year in case of a dispute.
What happens if a customer disputes a charge I took over the phone?
The processor will ask you to prove the customer authorized the payment. Provide any written record (email, order form, text message) or a recording of the call. If you cannot prove authorization, the processor will refund the customer and charge you a dispute fee (usually $15 to $100). Repeated disputes can get your account closed.
Do I need a different merchant account for phone payments than for online payments?
No. One merchant account works for phone, online, in-person, and mail payments. You pay different rates for each method (phone is highest, in-person is lowest), but it is all one account. Some processors charge a single rate for all methods, which is simpler but may cost more if you do mostly in-person payments.
What is the difference between a virtual terminal and a payment link?
A virtual terminal is a tool you use to enter card details yourself. A payment link is a URL you send to the customer, and they enter their own card details on a find page. Payment links are better for email or text, while virtual terminals are better for phone calls where you are talking to the customer in real time.
Can I use a personal credit card processor like PayPal or Venmo to take business payments?
Technically you can, but the terms of service for personal accounts usually prohibit business use. If the processor discovers you are using a personal account for business, they can freeze your account and keep the money. Always open a business account if you are taking payments for a business, even a small one.