Virtual Terminals and Keyed Transactions: The Card-Not-Present Penalty

A virtual terminal is a web form from your processor that lets you type a card number in and take the money. No card reader, no countertop box, just a browser and an internet connection. Two things have to exist behind it first: a merchant account and a payment gateway. And it costs you more per sale than the same card dipped in front of you, because a keyed card is a card-not-present transaction and the brands price card not present as the riskiest way to take payment. AVS and CVV cut your fraud losses. They don't cut your rate, and they don't move chargeback liability off you.

Most owners find the virtual terminal by accident. A customer calls to reorder, nobody can take the card over the phone, and the provider says oh, you already have that, log in here.

Then the statement arrives and the keyed sales look wrong.

They aren't wrong. They're priced differently, and nobody explained it.

What a virtual terminal is, and what sits behind it

The terminal part is a screen. Card number, expiry, security code, billing address, amount, submit. Any device with a browser works, so a laptop in the back office and a phone in a truck are the same tool.

The merchant account

This is what lets a business accept payments at all, sponsored by an acquiring bank and underwritten against your business type and expected volume. Without one there's nothing to deposit into.

Card-not-present volume changes how underwriting reads you. A shop keying 5% of its sales is routine. A business keying 100% of its sales, shipping product weeks after it charges the card, gets a harder look and sometimes a rolling reserve. Don't hide it on the application. Underwriting finds out anyway, and late means a frozen account rather than a slow approval.

The gateway

The gateway takes what you typed, encrypts it, and routes it to the payment processor for authorization. It's also where tokenization happens: the real card number gets swapped for a random ID, so live card details never sit in your systems. End-to-end encryption covers the trip from browser to processor.

Some merchant accounts include a secure payment gateway. Others bolt one on with its own monthly fee and its own per-transaction fee. Find out which you're getting, in writing, before you sign. (We have no monthly fees of any kind, so for our merchants that argument doesn't happen.)

The terminal does nothing on its own. Credit card processors marketing it as a standalone product are describing an aggregator account, which carries a different risk model and a much shorter fuse.

Why keying a card costs more than dipping one

Virtual terminal credit card processing is priced as card not present. That one classification drives most of the gap you're looking at.

Dip or tap a card and the chip proves the physical card was in the room. Key it and nothing proves anything. The person on the phone has a number, and numbers get sold in bulk. So card not present transactions carry a higher fraud risk, and interchange is built around risk. Keyed costs more than swiped. That direction doesn't reverse, and a rep quoting you a card-present rate for phone orders is quoting a rate you'll never see.

The downgrade mechanic

Interchange isn't a rate. It's hundreds of categories, and each of your credit card transactions lands in one of them based on what data showed up with it. Miss a required field and the transaction falls to a more expensive category. That fall is a downgrade, and it's where the surprise cost on keyed volume comes from. What interchange is has the machinery.

On keyed work the usual suspects are missing AVS data, a batch settled after the cutoff, and an authorization amount that didn't match what got captured. Nine times out of ten what's happened is a staff member tabbed past the ZIP field because the customer was in a hurry.

B2B is where this gets expensive and also where it's fixable. Commercial and purchasing cards have categories that want extra data: a purchase order number, a tax amount, line item detail. Supply it and the transaction qualifies for a better category. Skip it and you're paying for the privilege of not typing. Level 2 and Level 3 processing is the long version.

Small tickets get hit hardest

Percentage rates get all the attention. On small sales the per-item fee does more damage.

Say your pricing carries a 15 cent authorization fee. (An illustration, not a quote.) On a $400 invoice it's under four hundredths of one percent and invisible. On a $9 phone order the same 15 cents is 1.67% by itself, before any percentage rate touches it.

If your keyed volume is a pile of tiny tickets, your problem is the per-item, not the rate.

Debit cards keyed in

A debit card typed into a web form can't be a PIN debit transaction. No PIN pad, no PIN, so the sale runs over the signature rails as card not present and you lose the routing choice card-present debit gives you.

Regulation II still caps regulated debit interchange at 21 cents plus 0.05%, plus a cent for issuers meeting the Fed's fraud-prevention standard, and only for issuers holding $10 billion or more in assets. Smaller issuers are exempt and their debit runs higher.

Debit card payments are still cheaper for you than credit. Keyed, they're just less cheap than at a counter.

AVS and CVV: the two front-line screens

What AVS checks, and what override means

The address verification service sends the numeric part of the billing address your customer gave you, usually street number and ZIP, to the issuer, which compares it against what it has on file and returns a code. Full match. ZIP only. Street only. No match. Not supported.

That's the entire mechanism. A comparison against a record at a bank.

Override address verification is a setting, not a verification. It means your gateway has been configured to accept and settle a transaction whose AVS response came back partial or failed. Shipping departments turn it on because somebody typed Apt 4 where the bank has Unit 4. Turning it on isn't automatically wrong. Not knowing it's on is how a business discovers in month nine that it has been approving anything with a plausible number attached.

CVV, the three digits on the back

The card verification value is the security code printed on the card, three digits on the back for most brands and four on the front for Amex. It isn't in the magnetic stripe or the chip's static data, so a fraudster working from a breached database of card numbers often doesn't have it. That's the reason to ask.

You may never store it. Not in your CRM, not in a note field, not on an order slip in a drawer.

What neither of them does

This is where the pitch goes wrong, and it goes wrong constantly.

AVS and CVV do not lower your interchange. Missing AVS data can trigger a downgrade, so sending it keeps you out of a worse category, but a passing match earns you no discount from anybody.

AVS and CVV do not shift chargeback liability. On card-not-present volume the fraud liability is yours. You can get a full AVS match and a correct CVV and still eat the dispute, with the money leaving your account while you build a response. Those codes are evidence for the file. They are not a shield, and a salesperson who says otherwise either doesn't know or is hoping you don't. How to fight chargebacks covers what does help.

Taking card details over the phone

The customer experience on a phone payment is a person reading sixteen digits aloud to a stranger while somebody types. There's no way to make that graceful. You can make it safe.

Email and fax are not channels

Customers will email you card numbers. Some will fax them.

Don't accept it and don't invite it. An emailed card number sits unencrypted in your inbox, in their sent folder and in whatever backup runs overnight, and it drags your whole mail system into scope for card data security. A faxed one sits in a tray by the copier. This is the worst habit in small business payments and it's completely normal, which is the problem.

If sensitive payment information lands in your inbox anyway: run the sale, delete the message, empty the deleted folder, then send a link next time.

The better pattern takes your staff out of the card data path. You text or email a payment link and the customer keys their own card details into a hosted page, or an automated phone system captures the digits by keypad tone so nobody on the call hears a number. Call centres do this because of insider risk. Nine times out of ten the exposure is a temp with a pen, not a hacker.

PCI obligations on keyed and phone workflows

PCI DSS applies to virtual terminal and phone-payment workflows. It isn't an e-commerce rulebook. A business with no website and no card readers, taking every sale by phone, is in scope.

What I won't do is quote you a version number, a self-assessment type or a compliance date from memory. Those move, and which one fits depends on how your virtual terminal is deployed and whether anything on your premises touches card data. Ask your acquirer which SAQ applies. They're the ones who have to accept the answer.

The parts that don't move much: don't store security codes, don't keep card numbers you have no reason to keep, use a hosted page rather than a form your nephew built, and give every person their own login. Shared logins are how data breaches turn into investigations nobody can close. PCI compliance for small business goes deeper.

Invoices, deposits and remote selling

Three jobs, one screen. Reorders by phone. Invoices emailed with a link. A rep in a parking lot taking a deposit on a job that starts next month.

An authorization asks the issuer whether the account is open and has sufficient funds or open credit, and holds the transaction amount. Capture moves the money. On a deposit for work weeks out, authorize and capture when you take it, because authorizations go stale and reauthorizing a card that's since been reissued is a call you don't want to make in week three.

Voids and refunds come off the same interface as the original sale. A void kills a transaction before the batch settles; a refund lands after settlement as a separate credit. Use the void when you catch the mistake the same day.

Transaction history and detailed reporting live in the same place, which for phone orders replaces the paper log that always goes missing. Search by last four, amount, date, customer. Several staff can hold their own logins, though seat pricing varies by gateway.

Recurring and scheduled payments

The same virtual terminal interface will usually schedule a card: weekly, monthly, on the first, fixed or variable. For subscription based services, recurring billing is the difference between invoicing people and getting paid by them.

Build it on a token. If a provider's answer to recurring billing is for you to keep card numbers on file in your own system, you're running a card database on their behalf. Say no.

Cards expire and get reissued, and a recurring programme with no plan for that fails quietly while you assume money is arriving. Account updater services refresh the stored credential when the issuer sends a new card; ask whether yours is included or billed extra. A stored credential transaction also has to be flagged as one in the authorization. Flag it wrong and you get soft declines you'll blame on the customer's bank.

Make cancelling easy. You'll see claims that the FTC's click-to-cancel rule requires it. That rule was vacated in full by the Eighth Circuit on 8 July 2025, days before its compliance date, on procedural grounds. It is not in force, and anybody telling you to comply with it is reading a stale summary. Still live: ROSCA, which wants terms disclosed before you bill, express informed consent, and a simple cancellation method. Section 5 of the FTC Act. Your state's automatic renewal law, which may be stricter than either.

The commercial argument beats the compliance one anyway. Hard cancellation produces chargebacks, and a chargeback costs more than the subscriber.

Things that surprise people later

Funding times

No honest provider promises next-day money. Vendor pages saying funds deposit within about 24 hours are describing a best case with the batch cutoff quietly removed. Your real timing depends on the processor, when your batch closes against that cutoff, your own bank, and whether underwriting attached delayed funding or a reserve to a card-not-present account. Keyed-heavy accounts sometimes get exactly that. Ask for your timeline in writing. When do I get paid walks through it.

Cross-border and currency

A card issued outside the United States costs you more than a domestic card, keyed identically, because the brands apply assessments on cross border transactions and currency conversion can stack on top. Those rates get revised, so I'm not printing a percentage here. If you take international transactions, get them broken out on your statement instead of buried in a blended number.

Surcharging a keyed sale

The rules don't loosen because the customer isn't standing in front of you. Visa caps credit card surcharges at 3%, cut from 4% in April 2023. Mastercard publishes 4%. Both are also capped at your real cost of acceptance, and surcharging is prohibited on debit and prepaid cards, including a debit card run as signature over the credit rails. Thirty days' written notice to your acquirer before you start, then disclosure at the point of entry, at the point of sale and on the receipt.

On a phone order, point of entry means before you ask for the card. Say the total with the fee in it, out loud, and get a yes. These are card brand rules rather than statutes, and some states restrict the practice, so your rule set is a combination. A genuine posted cash price with a card price above it carries no network percentage cap, which is why a 4% cash discount program is built the way it is.

So what's the cheapest way to key cards?

There's no cheap way to key a card. There are less expensive arrangements.

The first thing I'd check is whether you're paying a gateway fee plus a monthly fee for a virtual terminal you use nine times a month. That's common. It's also silly.

Send us a statement

We're an independent sales organisation. We don't run a processing platform, we place merchants with larger nationwide processors, and because none of them owns us we can shop an account and argue on your side of the table.

Send three months of merchant statements and we'll read them properly: what your keyed volume costs, which categories it lands in, and whether the gateway is billed twice. Get a free savings analysis.

If your pricing is already good, we'll tell you so and leave you alone. That happens more than you'd think.

No contract on our side. Month to month, no early termination fee, cancel any time at no cost, no monthly fees. With those statements up front, approval can happen in as little as 24 hours. One named contact, not a call-centre queue.