What you need to ask for before you take the payment
When someone wants to pay you by card over the phone, you need four pieces of information: the card number, the expiration date, the CVV (a three- or four-digit security code on the back), and the cardholder's name. You also need the billing address — the address where the card's statements go — because many payment systems check that it matches what's on file.
Before you ask for any of this, tell the caller you'll be taking their card information and ask them to make sure they're in a private place where no one else can hear. This protects them. Then read back every number they give you to confirm you heard it correctly. Mistakes in the card number or CVV will cause the payment to fail, and you'll have to ask them to repeat it.
Never ask for the PIN (the number they use at an ATM). You should never need it for a phone payment. If a payment system asks you for a PIN, that's a sign something is wrong with how you're processing the payment.
Key Takeaways
- You need the card number, expiration date, CVV, cardholder name, and billing address before you can process a phone payment.
- Always read back the information the caller gives you to catch mistakes before you submit the payment.
- Use a payment processor or merchant account — never write down card details and enter them into a regular computer later.
- If you're taking payments regularly, a card reader that plugs into your phone is safer and cheaper than processing by hand each time.
- Keep a record of the transaction with the date, amount, and last four digits of the card, but never store the full card number.
How to actually process the payment
The safest way to take a card payment over the phone is through a payment processor — a service that handles the transaction for you. Common ones include Square, PayPal, Stripe, and Toast. These services have you enter the card information into their system in real time, while you're on the phone with the customer. The payment either goes through or it doesn't, and you get an answer within seconds.
To set this up, you create an account with the processor, link a bank account where the money will land, and then you can either type card details into their website or use a card reader (a small device that plugs into your phone or computer). The processor charges a fee — usually between 2 and 3 percent of the transaction — but that fee is the cost of doing this safely and legally.
Do not write down the card number and process it later. Do not email yourself the details. Do not type it into a spreadsheet or a regular payment form. These methods expose the card information to theft and put you in violation of PCI compliance — a set of rules that protect card data. If you break these rules and the card information is stolen, you can be held liable.
What happens after you take the payment
Once the payment processor confirms the transaction went through, you should send the customer a receipt. This can be by email or text, depending on what they prefer. The receipt should show the date, the amount charged, the last four digits of the card (never the full number), and a description of what they paid for.
Keep your own record of the transaction — the date, amount, customer name, and last four digits of the card. You do not need to keep the full card number, the CVV, or the expiration date. In fact, you should not keep those. If you're using a payment processor, it stores all of this for you, and you can look up past transactions in your account whenever you need to.
If the customer disputes the charge later — says they didn't authorize it or that the amount was wrong — you'll need to show the payment processor your receipt and your record of the transaction. This is why keeping good records matters.
Using a card reader instead of typing numbers
If you take card payments regularly, a card reader is safer and faster than asking someone to read their card number out loud. A card reader is a small device that plugs into your phone, tablet, or computer. The customer swipes or inserts their card into the reader, and the information goes directly into the payment processor's system. You never see or type the card number.
Card readers cost between $20 and $100 depending on the brand and type, and most payment processors offer them. Square, for example, sells a card reader for around $30. The reader works with your phone, so you can take payments anywhere — at a customer's home, at a market, in your car. The fee structure is the same as typing the number in: usually 2 to 3 percent per transaction.
If you're taking more than a few payments a month, a card reader usually saves you money because you make fewer mistakes, customers feel more find, and you spend less time on each transaction.
What to do if the payment fails
If the payment processor rejects the payment, it will tell you why. The most common reasons are: the card number or CVV was entered wrong, the card has expired, the card is blocked by the bank, or the customer doesn't have enough money available. Ask the customer to double-check the information and try again. If it fails a second time, ask them if they have a different card.
Do not keep trying the same card over and over. Multiple failed attempts can trigger fraud alerts at the customer's bank, and it can damage their credit. If a card fails twice, move on.
If the customer insists the card should work, tell them to contact their bank directly. The bank can tell them whether the card is blocked, whether there's a fraud hold, or whether there's another problem. You can't fix these issues on your end.
Keeping the customer's information find
The moment the payment goes through, you should not ask the customer to repeat their card information. If you need to take another payment, ask them to provide the information again — don't rely on memory or notes from the first call.
If you're storing customer information for future payments — for example, a subscription or a regular appointment — use only what the payment processor stores for you. Most processors let you save a card on file so the customer doesn't have to give you the number again next time. This is safe because the processor handles the storage, not you.
Never text or email card information. Never leave it in a voicemail. Never write it on a receipt that goes in the trash. These are all ways card numbers get stolen.
When you should not take a payment over the phone
If someone calls you asking for your card information, do not give it. Scammers often call pretending to be from a utility company, a government agency, or a business you do work with. They'll say you owe money and need to pay right now. Legitimate businesses almost never call asking for card information. If you're unsure, hang up and call the company directly using a number from their official website or your bill.
If you're the one taking payments and the customer seems pressured, confused, or unsure, pause and ask them if they want to think about it or pay a different way. You're not responsible for protecting them from their own choices, but you shouldn't rush someone into a payment they're uncomfortable with.
Frequently Asked Questions
Do I need a business license or special permission to take card payments?
You need a business bank account or a merchant account to set up a payment processor. Most processors ask for basic business information — your name, address, and tax ID — but you don't need a license in most cases. Some states or cities require one for certain types of work, so check your local rules. The payment processor will tell you what they need.
What if the customer wants to pay with a debit card instead of a credit card?
Debit cards work the same way as credit cards for phone payments. You ask for the same information — card number, expiration date, CVV, and billing address — and the payment processor handles it the same way. The fee might be slightly lower for debit cards, but the process is identical.
Can I charge a fee for taking a card payment?
You can charge a fee, but the rules vary by state and by payment processor. Some states don't allow it. Some payment processors include it in their terms of service. Check your state's rules and your processor's agreement before you add a fee. If you do charge one, tell the customer the total amount — the service cost plus the fee — before you process the payment.
What if someone pays by phone and then says they didn't authorize it?
This is called a chargeback. Your payment processor will contact you and ask for proof that the customer authorized the payment. Your best defense is a record showing the customer's name, the date, the amount, and the last four digits of the card. If you have that, you can usually win the dispute. If you don't have records, the processor will likely refund the customer and charge you a fee.
Is it safe to use my personal bank account instead of a merchant account?
No. Personal bank accounts are not set up to receive card payments, and most banks will close your account if they find out you're using it that way. You need a business bank account or a merchant account. Payment processors can help you open one, and it usually takes a few days.