Virtual Terminals: Taking Card Payments by Phone, Mail and Email Without a Machine

Every business that takes a card over the phone has a virtual terminal whether it calls it that or not. The difference between a good one and a bad one is the rate on those keyed transactions, whether stored cards are tokenized, and whether staff have a safe way to do it. This page covers all three.

What it is and who uses it

A virtual terminal is the “charge a card” screen inside your gateway. An employee logs in, enters the amount, card number, expiration, security code and billing ZIP, and clicks charge. It can also run refunds, voids, pre-authorizations, and, with a vault, charge a stored customer without re-entering the card.

Typical users: contractors taking deposits by phone, medical and dental offices collecting balances, B2B distributors taking purchase orders, law firms, property managers, wholesalers, nonprofits, and any retailer with phone orders. It is also the fallback when a terminal goes down.

What keyed transactions cost

Keyed transactions are card-not-present. Interchange is higher than in-person, and most providers price them higher still.

On $20,000 a month keyed, 3.5% is $700; interchange-plus at 2.4% all-in is $480. The gateway fee difference is a rounding error next to that.

How to lower the keyed rate

Card-not-present interchange has tiers. A keyed transaction with no supporting data lands in the most expensive one. Supplying data moves it down:

• AVS. Billing ZIP and street address checked against the card issuer. Required for the better tiers and for chargeback defense.
• CVV. The three or four-digit code. Never stored, always entered.
• Level 2 data. Tax amount, customer code, invoice number. Qualifies commercial cards for lower interchange. Most virtual terminals have the fields; staff have to fill them.
• Level 3 data. Line items, quantities, commodity codes. Larger reduction on corporate and purchasing cards. Covered in Level 3 processing.
• Settle within 24 hours. Late settlement downgrades.

A gateway that supports Level 2 and 3 and a processor on interchange-plus is what makes these reductions show up on your statement. On flat-rate pricing, nothing you do changes the rate.

Storing cards for repeat customers

The gateway’s vault tokenizes the card. Staff store it once, with the customer’s permission, and future charges reference the token. The token is useless outside your account. If a laptop is stolen, no card numbers are on it.

Never: paper forms in a drawer, spreadsheets, notes in a CRM, card numbers in email or text. All of those are PCI violations, and in a breach they are the difference between a bad week and a lawsuit.

Pay links: the cheaper alternative for many keyed charges

If the customer can act, send them a link instead of keying. A pay-by-link or text-to-pay message opens a hosted page where the customer enters their own card. It is still card-not-present, but it removes your staff from the card data (smaller PCI scope), captures AVS and CVV from the customer directly, and usually costs the same or less. Contractors and service businesses get paid faster this way because the customer pays from their phone the same evening. Our contractors and service page covers the setup.

PCI for the office

The gateway is PCI Level 1. Your side, for a virtual terminal on a dedicated workstation, is SAQ C-VT: a short questionnaire covering the computer, the network and staff practices. The rules that matter day to day: unique logins per employee, no card data written down or stored outside the vault, a computer that is not also used for personal browsing, and annual completion of the SAQ so you are not charged a PCI non-compliance fee.

Which gateway

All of the standalone gateways above connect to a merchant account we price on interchange-plus, with keyed and card-present channels on one statement.