What you need before you take a card payment by phone

To take a card payment over the phone, you need the cardholder's full name, the card number, expiration date, and the three-digit security code on the back (called the CVV or CVC). You also need to know the billing zip code. The cardholder must give you this information verbally — you cannot ask them to text it, email it, or send it through an unsecured channel.

You need a way to process the payment. This means either a merchant account with a payment processor (like Square, Stripe, or your bank), a virtual terminal that lets you enter card details into a secure form, or a phone-based payment system. If you do not have one of these, you cannot legally accept card payments. Do not write down the card number and process it later through a different system — that creates a record of the full number and violates card network rules.

You also need to tell the cardholder the total amount before they give you their card number, and confirm it again after you process the payment. Write down the authorization code the processor gives you, the last four digits of the card, the amount, the date, and the cardholder's name. Keep this record for at least three years.

Key Takeaways

  • Never write down or store the full card number — use a secure payment processor or virtual terminal that encrypts the data as it enters the system.
  • Ask for the card number, expiration date, CVV, and billing zip code only over the phone, and only from the cardholder themselves.
  • Confirm the total amount before processing and get an authorization code from your processor to prove the transaction went through.
  • Keep a record of the last four digits, amount, date, and cardholder name for three years in case of disputes or chargebacks.
  • If the payment is declined, ask the cardholder to contact their bank or try a different card — do not ask them to repeat the number multiple times.

How to process the payment step by step

First, tell the cardholder the exact amount you are charging, including any fees or taxes. Wait for them to confirm they agree to that amount before you ask for card details.

Second, log into your payment processor's virtual terminal or phone payment system. This is a secure web page or app where you enter card information. Do not use email, text, or a regular web form.

Third, ask the cardholder for the information in this order: full name as it appears on the card, card number, expiration date (month and year), and the three-digit security code on the back. Read the number back to them to confirm you heard it correctly. Ask for the billing zip code last.

Fourth, enter all this information into the virtual terminal. The processor encrypts it immediately — you should never see the full number displayed on your screen after you enter it. Click process or submit. The system will return an authorization code (a string of numbers and letters) within seconds or minutes.

Fifth, tell the cardholder the payment went through, give them the authorization code, and tell them the last four digits of the card that was charged. Send them a receipt by email or mail if they ask for one.

What to do if the payment is declined

If the processor declines the payment, it will show you a reason code — "insufficient funds," "expired card," "incorrect CVV," or "card not activated" are common ones. Tell the cardholder the reason without repeating the card number out loud. Do not ask them to give you the number again.

Instead, ask them to contact their bank or card issuer directly. The bank can tell them why the card was declined and whether it can be used. If the cardholder wants to try a different card, they can give you that number instead. If they want to use the same card, they need to call their bank first.

If a card is declined three times in a row, stop trying. Multiple declined attempts can trigger fraud alerts on the account or lock the card temporarily. Ask the cardholder to resolve the issue with their bank and call you back when they are ready.

Keeping the transaction secure

Never write the full card number on paper, in an email, in a text message, or in a spreadsheet. The only place the full number should ever exist is inside your payment processor's encrypted system. If you write it down, you become responsible for protecting it under payment card industry rules, and a breach becomes your liability.

Do not ask the cardholder to email or text their card number to you. Do not use a regular contact form on your website. Do not process the payment through PayPal, Venmo, or another peer-to-peer app unless the cardholder explicitly asks you to and understands those services are not designed for business payments.

If you use a virtual terminal, log out when you are done. If you take payments on a phone or tablet, use a payment app designed for that purpose (like Square Reader, Stripe Terminal, or your processor's official app) rather than typing numbers into a browser.

What happens if there is a dispute or chargeback

A chargeback occurs when a cardholder tells their bank the charge was unauthorized or the product or service was not delivered. The bank pulls the money back from your account and charges you a fee (usually $15 to $100). You then have a chance to dispute the chargeback by providing proof the transaction was legitimate.

This is why you need to keep records. Save the authorization code, the date and time of the call, the cardholder's name, the amount, and a note about what was purchased or what service was provided. If the cardholder signed a contract or gave written consent, keep that too. If you can show the bank that the cardholder authorized the charge and received what they paid for, the bank will usually return the money to you.

If chargebacks happen repeatedly from the same cardholder or if you cannot provide proof of authorization, your processor may flag your account as high-risk or close it. This is why confirming the amount and getting an authorization code matters — it creates a paper trail.

Payment processors that accept phone payments

Most major payment processors offer a virtual terminal or phone payment option. Square, Stripe, PayPal, Authorize.net, and most banks' merchant services all have this feature. Some charge a flat fee per transaction (usually 2.5% to 3.5% plus $0.30), while others charge a monthly fee plus a lower per-transaction rate. Compare the costs based on how many phone payments you expect to take per month.

If you already have a merchant account with your bank, ask whether they offer a virtual terminal. If you do not have one, you can open a merchant account online in minutes with most processors. You will need your Social Security number or business tax ID, a bank account to deposit payments into, and a few minutes to fill out an application.

When phone payments are not the right choice

If you take card payments regularly, a physical card reader or online payment form is faster and more secure than phone payments. A card reader lets the cardholder swipe or insert their card themselves, which means you never see the number. An online payment form (like a Stripe checkout page) lets customers enter their own details into an encrypted page.

Phone payments are best for one-time transactions, customers who cannot use a card reader or online form, or situations where the cardholder calls you. If you are setting up a business that takes payments regularly, invest in a card reader or online payment system instead. The security is better, the fees are often lower, and you avoid the liability of handling card numbers yourself.

Frequently Asked Questions

Can I write down the card number and process it later?

No. Writing down the full card number creates a record you are responsible for protecting, and processing it outside a secure payment processor violates card network rules. Always enter the number directly into your processor's virtual terminal while the cardholder is on the phone with you.

What if the cardholder asks me to text them a payment link instead?

You can send a payment link from your processor (like a Square invoice or Stripe payment link), but the cardholder should click it and enter their own card details into the secure form. Do not ask them to text you their card number. If they prefer to give it verbally, process it through your virtual terminal instead.

Do I need to tell the cardholder about the CVV before they give it to me?

Yes. Tell them it is the three-digit number on the back of the card (or four digits on the front for American Express). This prevents confusion and makes sure they are giving you the right number. Never ask for the CVV via email or text.

What if the cardholder's bank calls me asking about the charge?

Give them the authorization code, the date and time of the transaction, the amount, and confirm that the cardholder authorized it. Do not give them the full card number or any details beyond what you recorded. If they need more information, direct them to contact the cardholder directly.

How long do I have to keep records of phone payments?

Keep records for at least three years. This includes the authorization code, date, time, cardholder name, last four digits of the card, amount, and what was purchased or what service was provided. After three years, you can destroy the records securely.