Taking Orders on the Phone

[Donshon]

Hi,

I wanted to know if it's legal to ask customers for their card details over the phone to process orders?

I've heard conflicting things about this. One from another business owner who has told me it's fine to do so and they've been doing it that way for years. Another from a design company I've had dealings with in the past that say it is not legal.

To describe the specific process it would be as follows:

• The customer wants to pay with their credit/debit card over the phone.
• Customer's Name and card details including security number (on the rear of the card) are taken.
• The order is then processed.

I'd wonder if someone could clarify for me if this is actually legal or not.

If not, do you know where the official legal documentation regarding this would be?

Any help would be greatly appreciated.

Best Regards,

Donshon

 

[StevensOnln1]

I doubt there is any legal documentation on methods of taking card payments. It comes down to the merchant account facility that you have and whether it allows you to take MOTO (mail order/telephone order) payments where you enter the card details yourself, rather than the customer entering their card details online or presenting their card (or phone with Apple Pay/Android Pay/Samsung Pay etc) at a physical terminal.

 

[Bainzee]

its nothing to do with legality. if you have a card machine for which you normally use for face to face transactions then the card terminal provider will normally configure the terminal for telephone orders.
You will have no problems with processing such transaction. You may be charged a very small fee doing so by your merchant bank

 

[fisicx]

My local takeaway does CC payments over the phone as do any number of shops with telephone ordering. I placed an order for a windcreen wiper motor today, I could hear him entering my details on the keyboard. My car insurance does the same.

What you need to be is PCI compliant.

 

[Rob Ellis]

As others have said - taking the payment is fine, as long as it is handled in a PCI compliant way - for example the handler should not 'read back' the card number as you are providing it (because someone else could be listening, etc.)

 

[Nochexman]

I wanted to know if it's legal to ask customers for their card details over the phone to process orders?

Are you already processing payments in some other way, such as using a point of sale machine or via the internet?

The answer to your question is that it is legal to ask so long as you have something to process the payments with!

 

[Gecko001]

I have given my card number over the phone many times, but it was always to large firms or organisations, or small firms I could trust. If I was buying a second hand mobile phone from someone on Gumtree and they said I could pay by credit card, I would think twice. Also, I would certainly not given my mastercard number for something I bought as a result of someone cold-calling me.

I suppose it is down to the terms and conditions of your card company.

 

[lpbusiness]

Not really a legal issue, more to do with your card company. Loads of businesses take orders over the phone. Would usually only give my details to those who appeared trustworthy.

 

[Root 66 Woodshop]

We take payments over the phone all the time, it's all about inputting details there and then - rather than jotting them down which a lot of companies use to do.

 

[TotalWebSolutions]

As above nothing to do with legality, more whether your existing system allows you to do so. If you have a card terminal then you need CNP (Card Not Present) enabled to allow you to enter the card details as given by the customer, in a secure PCI compliant manner.

If you have a Payment Gateway service then you can have a Virtual Terminal that allows you to process MOTO (Mail Order / Telephone Order) payments.

If you do use order forms and/or collect card details ensure that these are destroyed/stored in a secure way that meets PCI (Payment Card Industry) compliance requirements.

 

[Darren Fletcher]

As a comms Company we provide phone systems with call recording and as long as you do not record the call with the card numbers on it (which we can stop by the way) you will remain PCI compliant.

Other than that you are well within your rights to take card numbers over the phone.

Darren

 

[Donshon]

Thanks for all of your replies people.

Much appreciated, this really helped!