Reference guide
What is MOTO? Card payments by phone.
What MOTO means, and what PCI SSC and Nacha require when payments come by phone.
- MOTO means mail-order/telephone-order: card-not-present payments the cardholder starts by phone or mail.
- Never keep the card verification code after authorization, including inside call recordings.
- Mask card numbers on screens; store full numbers only in unreadable form.
- Your acquirer confirms which PCI self-assessment questionnaire applies.
Definitions
What MOTO means
- The acronym
- MO/TO stands for Mail-Order/Telephone-Order, in the PCI DSS glossary.
- Card-not-present
- PCI DSS names mail and telephone orders as card-not-present channels needing protection.
- Cardholder initiates
- Stripe: submit MOTO only when an absent cardholder instructs by phone or mail.
- What gets keyed
- Stripe's MOTO flow prompts for card number, CVC, expiration date and postal code.
- Identity checks
- Stripe says the business is responsible for verifying the customer's identity.
Four setups
Taking card payments over the phone: four setups
Your acquirer, not PCI SSC, confirms which SAQ fits your setup.
| Setup | What the agent handles | What PCI SSC says |
|---|---|---|
| Agent keys into a virtual terminal | Hears and types the card number | SAQ C-VT: one isolated device, hosted terminal, no card readers |
| Customer keys digits, tones masked (DTMF) | Hears flat tones; may see asterisks | Flat-tone-only recordings need not be rendered unreadable |
| Pause-and-resume recording | Still hears the card details | Recorder may leave scope; the agent desktop does not |
| Payment link by text or email | Sends a link; the customer pays online | May count like e-commerce redirection; scope needs evaluation |
PCI DSS v4.0.1
PCI DSS rules that apply on every call
Full card numbers are shown only to documented roles with a business need.
| Requirement | What it says |
|---|---|
| 3.3.1 | Sensitive authentication data is not stored after authorization, even encrypted |
| 3.3.1.2 | The card verification code is not stored after authorization |
| 3.4.1 | Displayed card numbers masked: BIN and last four at most |
| 3.4.2 | Remote access cannot copy or move card numbers without authorization |
| 3.5.1 | Card numbers are unreadable anywhere they are stored |
Call recordings
Call recordings and card data
- No stored CVV
- PCI SSC: verification codes kept in audio recordings after authorization violate 3.3.1.
- Suppress or redact
- Where technology can suppress or redact audio during card entry, enable it.
- Delete immediately
- If a code is recorded anyway, securely delete it upon authorization.
- Screen recordings too
- Screen or video recordings showing card data must be equally secured.
- Check paused recordings
- With pause-and-resume, verify recordings hold no card data, preferably weekly.
- Local law still applies
- PCI DSS does not override local or regional audio retention laws.
Call center controls
PCI compliance for call centers, in practice
- Card numbers in notes
- A card number typed into a notes field is stored card data under 3.5.1.
- Mask every screen
- Show at most the BIN and last four digits on agent screens.
- Nowhere for the CVV
- No field, note or log keeps the verification code after authorization.
- Agent desktop in scope
- Pause-and-resume does not reduce PCI DSS applicability to agents or their desktops.
- Validation is set elsewhere
- Card brands and acquirers, not PCI SSC, set compliance validation requirements.
- Ask about your SAQ
- PCI SSC tells merchants to confirm SAQ eligibility with their acquirer or brand.
Bank payments by phone
Taking ACH payments over the phone
- TEL entries
- A TEL debit is authorized orally by a consumer over the telephone.
- Single payment
- Record the oral authorization, or send written notice before the debit settles.
- Keep it two years
- Retain the recording or notice for two years from the authorization date.
- Recurring payments
- Follow Reg E, send the consumer a copy, keep evidence two years past revocation.
- Voice over the internet
- Authorizations by voice assistant or video call are WEB entries, not TEL.
- Secure transmission
- Banking details sent over unsecured networks must be encrypted or use a secure session.
Questions
What people ask about MOTO.
- What is MOTO?
- Mail-order/telephone-order: card payments where the cardholder is not present.
- Is a phone payment card-present or card-not-present?
- Card-not-present. Stripe classifies MOTO that way, and PCI DSS groups it with e-commerce.
- How do you take credit card payments over the phone securely?
- Mask card numbers, never store the CVV, and keep card data out of recordings.
- Can call recordings keep the CVV?
- No. PCI SSC calls stored verification codes in recordings after authorization a violation.
- Who decides which SAQ a call center uses?
- Card brands and acquirers set validation. PCI SSC says ask your acquirer.
- Can I take ACH payments over the phone?
- Yes, as TEL debits, with a recording or written notice before settlement.
Sources
Where every fact comes from.
Primary sources only. Rules change, so check the date above.
- PCI SSC: PCI DSS v4.0.1, June 2024 (document library)
- PCI SSC FAQ 1210: audio recordings and sensitive authentication data
- PCI SSC: Protecting Telephone-Based Payment Card Data, v3.0 (2018)
- PCI SSC blog: updates for merchants validating to SAQ A (2025)
- PCI SSC: merchant resources and SAQ guidance
- Stripe Docs: Mail order and telephone order payments (processor doc)
- PCI SSC: SAQ C-VT v4.0.1 (document library)
- Nacha ACH Guide for Developers: ACH File Details (TEL entries)
- Nacha: Meaningful Modernization rules and FAQ (oral authorizations)
- CFPB: Regulation E, 12 CFR 1005.10 preauthorized transfers
After the cart
Need this built or fixed?
Thirty minutes with the people who build it.
