Taking Card Payments Over the Phone: PCI DSS Rules for Small Businesses

Taking card payments over the phone is legal and routine, as long as your payment provider has switched on telephone payments and you handle the card details safely. The four common methods are a virtual terminal in your web browser, keyed entry on your card machine, a payment link the customer completes themselves, and keypad entry (DTMF) or an automated payment line for busier teams. Whichever you choose, the rules that matter most are simple: never keep the card security code, never take card numbers by email, and keep card details out of notes, spreadsheets and recordings.

This guide, from a PCI SSC-approved Qualified Security Assessor (QSA) company, adds what payment providers’ how-to guides leave out: the PCI DSS questionnaire each method leads to, and what makes you ineligible for the short ones. It is written for small businesses and sole traders; if you run a contact centre, read our guide to contact centre PCI compliance instead.

How do you take card (credit or debit) payments over the phone?

Ask your payment provider to enable telephone payments, often called MOTO (mail order, telephone order), then choose how the card details will reach the provider:

1. Virtual terminal: you type the customer’s card details into a secure web page hosted by your provider, one payment at a time.
2. Card machine keyed entry: you type the card number into your card machine while the customer is on the line, if your provider allows keyed transactions.
3. Payment link: you send a link by text or email, and the customer enters their own card details on the provider’s hosted payment page.
4. DTMF masking or a payment IVR: the customer types their card number on their phone keypad, and the tones are hidden from you and from any recording, or the call is passed to an automated payment line.

Every method ends the same way: the provider authorises the payment, and the customer’s receipt should never show the full card number.

Which PCI SAQ does each phone payment method lead to?

How you take phone payments decides which Self-Assessment Questionnaire (SAQ) you complete each year. The table shows the usual outcome; your acquirer has the final say, and you must meet every eligibility criterion in the SAQ itself.

If your card machines belong to a PCI-listed point-to-point encryption (P2PE) solution, ask your provider whether keyed telephone payments are covered by it; if so, SAQ P2PE may apply. If you take payments in more than one way, each channel may need its own SAQ, or your acquirer may ask for a single SAQ D. The full eligibility rules are in each questionnaire in the PCI SSC SAQ library.

What must you never do when taking card payments by phone?

These habits cause most problems, and several move you straight to SAQ D:

• Never write down or keep the security code. Key it only into the payment screen. PCI DSS Requirement 3.3.1.2 forbids keeping it once the payment is authorised, on paper, in a system or in a recording.
• Never take card numbers by email, text, web chat or social media messages. Requirement 4.2.2 requires strong cryptography whenever card numbers are sent by end-user messaging, and receiving them brings your mailbox, phone or chat tool into scope.
• Never record card details in calls. If you record calls, pause the recording for the payment or use DTMF masking.
• Never put card details into spreadsheets, CRM notes or booking systems. Use your provider’s tokens or saved-card feature for repeat customers instead.
• Never repeat the full card number aloud where others can hear it.
• Never use a personal phone or laptop to key payments.

Can I write down card details taken over the phone?

Avoid it, and never write down the security code at all. The safest habit is to key details straight into the virtual terminal or card machine while the customer is still on the line. If a card number does end up on paper, PCI DSS expects it to be physically secured (Requirement 9.4.1) and destroyed when no longer needed by cross-cut shredding, incineration or pulping (Requirement 9.4.6). A notepad by the phone or a stack of booking forms with card numbers on them will not pass.

What UK regulations apply to taking card payments over the phone?

No UK law bans taking card payments over the phone, and telephone payments are a standard card-not-present transaction type, so no special licence is needed beyond your merchant agreement. Four sets of rules apply:

Because SCA does not apply, a phone payment made with a stolen card normally comes back to you as a chargeback. Use the address and security code checks your provider offers; our explainer on card-not-present fraud covers the risks. This table is a summary, not legal advice.

What is the safest way to take card payments by phone?

The safest method is the one where nobody in your business ever hears or sees the card number. In order of exposure:

Larger teams weighing up masking should read our PCI IVR guide, which compares DTMF masking, IVR and pause-and-resume.

Can staff take phone payments from home?

Yes, but it is harder to do well. If a home worker hears or keys card details, their workspace and device are in scope, and SAQ C-VT’s requirement for an isolated computer is hard to meet with a laptop that also connects to your office network.

For most small businesses, payment links are the simplest answer for home workers: the worker never hears the card number, so their laptop and home broadband stay out of the payment flow. If home workers must key payments, use company-managed devices, require multi-factor authentication for any remote access into your systems (Requirement 8.4.3) and set clear rules: no one else present, no notes, no recordings.

Want to take card payments on your phone instead?

If the customer is with you rather than on a call, you can take card payments on your phone with a tap to pay app from your payment provider, which lets a phone or tablet accept contactless cards in person. The PCI SSC standard for these apps is PCI MPoC, and our guide to how you can take card payments on your phone explains what to check before you switch one on.

Checklist for taking card payments over the phone

Use this one-page check before you take your first phone payment, and again each year when you complete your SAQ:

• Telephone (MOTO) payments enabled on your merchant account.
• One method chosen for phone payments, and staff know it.
• Card details keyed directly during the call, or sent by payment link.
• The security code is never written down, typed into notes or recorded.
• Card numbers are never accepted by email, text or chat.
• No card numbers in spreadsheets, CRM notes or booking systems.
• Any paper with card numbers locked away and cross-cut shredded after use.
• Call recording paused or masked during payment, or not used.
• Virtual terminal used only on a dedicated, up-to-date, isolated computer.
• Only named, trained staff take payments, with their own log-ins.
• Your provider’s Attestation of Compliance on file and checked every year.
• The right SAQ completed and submitted to your acquirer every year.

Want to see where you stand? Our PCI compliance check asks a short set of questions and points you to next steps.

Do you still need to complete an SAQ?

Yes. Your acquirer expects you to validate PCI DSS compliance once a year, and for a small business that usually means an SAQ completed through an online portal run by or for the acquirer; our Worldpay PCI compliance guide shows how one acquirer’s programme works. Choosing the right phone payment method is the biggest lever on that workload: moving from keyed payments to payment links can turn a longer questionnaire into a much shorter one. Our guide to the cost of PCI compliance for a small business shows how your set-up affects the time and money involved. The PCI SSC also publishes guidance on protecting telephone payment data in its document library.

Why Sovereign Secure

Sovereign Secure Ltd (Companies House 08334453, incorporated 2012) is headquartered in Accrington, Lancashire. The PCI Security Standards Council has approved us as a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA) and a Card Production Security Assessor (CPSA), and we are a member of its Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.

This is an independent guide: we do not rank or recommend payment providers. We help businesses confirm which SAQ applies to the way they actually take payments, and assess them where their acquirer needs a QSA.

Next step

Not sure which questionnaire your phone payments fall under? Tell us how you take payments and we will confirm your SAQ and send a fixed quote for any help you need. Contact our PCI team or call +44 161 523 5276.