Virtual Terminal Credit Card Processing for Phone & Mail Orders

01 / Pick the right entry point

Three remote-payment tools do different jobs.

A physical retail terminal may support keyed entry, but keying does not turn a remote order into a card-present sale. Ask whether the account is approved for each method and what fee category applies. Some merchants use both a virtual terminal for calls and links for invoices; request a demonstration of the exact tool and permissions included in your quote.

02 / Price the whole workflow

Include gateway and account charges.

This fictional month has $30,000 in card-not-present sales across 300 payments. It is an arithmetic example, not a Payment USA rate or quote. Compare the same sales mix and period in every proposal.

Offer B has the lower headline percentage but costs $25 more in this example. At a different volume or ticket size, the order can reverse. Add any authorization-only charges, monthly minimum, PCI program fee, payment-link fee, token or recurring fee, refund and dispute treatment, and terminal or software cost. A gateway fee may be billed by a separate company. Get all recurring charges and cancellation terms in writing.

03 / Know the transaction state

Approval is not the same as a completed sale.

1. Authorize: ask the issuer to approve an amount. An approval is not a funding promise or proof that the customer agreed to every later charge.
2. Capture: submit an approved transaction for settlement after the sale is ready. Ask how long your configured tool allows between authorization and capture.
3. Void or reverse: cancel an authorization or unsettled transaction when possible. The exact button and window depend on the gateway and batch state.
4. Refund: return funds on a settled sale through the configured refund process. Ask how original processing fees are treated.

Design the office procedure around who can enter a sale, capture it, issue a refund and change a stored token. Reconcile each transaction to an invoice, customer permission and delivery record. A disputed phone order is easier to investigate when staff can find the date, amount, receipt, consent and fulfillment evidence without hunting through email.

04 / Limit card-data exposure

Tokenization helps, but scope depends on the channel.

Use an approved provider feature for repeat billing, with clear customer permission, rather than a spreadsheet of card numbers. A token can represent a card in the provider’s system, but it does not authorize a recurring schedule by itself. PCI SSC says card verification codes may be requested for a specific card-not-present authorization but cannot be stored afterward, even encrypted. Read the PCI SSC rule.

A hosted payment page can reduce what your systems touch, but outsourcing does not erase merchant PCI responsibilities. Ask who is responsible for the page, access, provider oversight and evidence of compliance. Your acquirer or compliance program determines the applicable validation path for your whole environment.

05 / Launch deliberately

Bring a real operating checklist to the quote.

Do not assume a named accounting, invoicing or gateway product connects to every account. Ask for confirmation of the exact integration and who configures it. Keep the current acceptance path until the new account is approved, staff are trained and a small live transaction can be reconciled. This prevents an avoidable gap in collections.