MOTO Payments Secure card-not-present payments without the PCI scope

A MOTO payment is a card transaction where the cardholder isn't physically with you and their card isn't either. MOTO stands for Mail Order / Telephone Order — the original category the card schemes used for catalogue orders, phone sales, fax orders and invoice payments. Today it covers anything where the customer reads or keys their card details across a phone line, an email, a fax, or a written order form. The card schemes treat it as card-not-present (CNP), which means higher interchange rates and full chargeback liability for you.

Card-present means you've got the card and the cardholder in front of you — chip and PIN, contactless, swipe. MOTO means neither the card nor the cardholder is with you; the customer shares their details remotely. Interchange fees for MOTO run roughly 0.1–0.3% higher than card-present because card issuers see it as higher fraud risk, and chargeback liability sits with you rather than the customer's bank.

IVR is one flavour of MOTO. A MOTO payment is any card-not-present transaction taken over a phone or written channel. An IVR payment is specifically a MOTO payment taken by an automated voice response system with no agent on the call. If you want the agent to stay on the call and help the customer through, that's agent-assisted MOTO with DTMF masking. If you want it fully automated, that's IVR. Both are MOTO, both use the same card schemes, both need the same PCI thinking.

The risky way is: your agent reads the card number aloud, writes it on a form, or your call recording captures it. Any of those and you're in full PCI DSS SAQ D scope — 329 controls, annual audits, trained staff, secure rooms. The safer way is to route the card capture through a PCI-certified provider. With Paytia, the customer types their card on their own phone keypad, we mask the tones so the agent hears nothing, and we send the card straight to your gateway. Your scope drops to SAQ A (22 controls) and nothing sensitive ever lands in your systems.

Yes, and they often are. We tokenise the card on the first transaction and use the token for every subsequent charge — subscriptions, payment plans, instalments, renewal invoices. The customer only reads or keys their details once. Every charge after that runs off a token that lives in our environment, not yours, so you can bill every month without storing a single card number.

You need a merchant account set up for card-not-present transactions. Most UK acquirers (Barclaycard, Worldpay, Tyl by NatWest, Elavon, and others) offer MOTO as an add-on to a standard card-present account, sometimes as a separate MID. Pricing is usually a per-transaction uplift. We plug into any of them — you keep your existing acquirer, we handle the capture and tokenisation layer on top.

Yes — 3DS2 works for MOTO where the customer has a mobile handy for the authentication step. Where they don't, MOTO falls back to non-authenticated CNP, which is why fraud screening and tokenisation matter more. Our platform applies 3DS2 when it can and flags high-risk transactions when it can't, so you're not flying blind on fraud.