Mail order / telephone order (MOTO) is a card payment where the customer gives card details by phone, post, fax or email and the merchant keys them into a terminal or virtual terminal on the customer's behalf; card scheme rules flag it as a separate category from e-commerce. Hotels, travel agents, charities, pharmacies, utilities and B2B suppliers use it. Because the payer does not initiate the payment electronically, PSD2 places MOTO outside strong customer authentication, and flagging web checkouts as MOTO to avoid 3DS breaches scheme rules. Without authentication, the merchant carries chargeback liability, relying on address and CVV checks. Spoken card numbers bring phone lines and call recordings into PCI DSS scope.
MOTO transaction explained
The defining feature is that the cardholder never interacts with the payment system. They cannot insert a card, tap a phone or complete a 3-D Secure challenge. The merchant's staff type in the card number, expiry date and usually the CVV, and the transaction is sent to the acquirer with a MOTO indicator.
Typical users are hotels taking phone bookings, travel agents, charities running phone appeals, pharmacies and utilities with older customers, and B2B suppliers taking orders by phone.
How do mail order telephone order payments work
- The customer reads out card details over the phone or writes them on a form.
- An agent enters them into a virtual terminal supplied by the payment gateway or a keypad on a physical POS.
- The acquirer sends a normal card-not-present transaction authorization marked as MOTO.
- The issuer approves or declines, usually after address and CVV checks.
Settlement then follows the same path as any other card sale.
MOTO and strong customer authentication
Under PSD2, MOTO payments are out of scope of strong customer authentication because they are not initiated electronically by the payer. This is not an SCA exemption the issuer can reject; the transaction is simply outside the rule. Regulators and schemes watch for misuse: a merchant that flags web checkouts as MOTO to avoid 3DS breaches scheme rules and can lose its merchant account.
Fraud and liability
Without authentication, the merchant carries the chargeback liability on MOTO transactions. Fraud rates are higher than card-present, and schemes often price MOTO at card-not-present interchange. A merchant doing €40,000 a month in phone sales with a 0.5% chargeback rate faces about 10 to 20 disputes each month depending on ticket size, each with its own fee.
Address verification service checks and CVV matching are the main tools available, plus sending goods only to the verified billing address.
PCI DSS in the call centre
Spoken card numbers put phone lines, call recordings and agent desktops into PCI DSS scope. The CVV cannot be stored after authorization, so recordings that capture it breach the standard. Common fixes are pausing recordings during payment or DTMF masking, where the caller types digits on their keypad and the tones are hidden from the agent.
In due diligence on a merchant or payment business, a high MOTO share is worth examining: it raises chargeback exposure and can indicate SCA avoidance.