MOTO Payments — Secure card-not-present orders without the PCI scope

A MOTO payment is a card transaction where the cardholder isn't physically with you and their card isn't either. MOTO stands for Mail Order / Telephone Order — the original category the card networks used for catalog sales, phone orders, fax orders, and mail-in invoice payments. Today it covers anything where the customer reads or keys their card across a phone line, an email, a fax, or a paper order form. Visa, Mastercard, and the other US networks treat it as card-not-present (CNP) — higher interchange and full chargeback liability sit with you.

Card-present means you've got the card and the cardholder in front of you — chip, contactless, or swipe. MOTO means neither the card nor the cardholder is with you; the customer shares their details remotely. CNP interchange in the US runs roughly 0.10–0.30% above card-present because issuers see it as higher-risk, and chargeback liability sits with you rather than the issuing bank. The numbers vary by card brand and merchant category, but the direction is always up.

IVR is one flavor of MOTO. A MOTO payment is any card-not-present transaction taken over a phone or written channel. An IVR payment is specifically a MOTO payment taken by an automated voice system with no agent on the call. If you want the agent to stay on and walk the customer through, that's agent-assisted MOTO with DTMF masking. If you want it fully automated, that's IVR. Both are MOTO, both go through the same card networks, and both need the same PCI thinking.

Recording the call itself is generally fine if you have one-party or all-party consent depending on the state — California, Florida, and a handful of others require all-party consent. The bigger problem is what's in the recording. If your recording captures the customer reading out 16 digits, that recording is now in PCI scope and a target for breach. With Paytia, the customer keys the card on their own keypad, the tones are masked in real time, and the recording stays clean — no card data, nothing to redact later.

The risky way: your agent hears the card number aloud, writes it on a form, or your call recording captures it. Any of those puts you in full PCI DSS SAQ D scope — 329 controls, annual audits, trained staff, secure rooms. The safer way is to route the card capture through a PCI-certified provider. With Paytia, the customer types the card on their own phone keypad, we mask the tones so the agent hears nothing, and we send the card straight to your processor. Your scope drops to SAQ A (22 controls) and nothing sensitive lands in your systems.

Yes, and they often are. We tokenize the card on the first transaction and use the token for every subsequent charge — subscription boxes, payment plans, installment programs, monthly catalog renewals. The customer reads or keys their details once. Every charge after that runs off a token that lives in our PCI environment, not yours. You bill every month without storing a single card number.

You need a merchant account set up for card-not-present transactions. Most US processors — Stripe, Chase Payment Solutions, Braintree, Authorize.Net, Adyen, Worldpay (US) — offer MOTO as either an add-on to a standard CNP MID or a separate MID. Pricing is usually a per-transaction uplift over card-present rates. We plug into any of them: you keep your existing processor, we handle the capture and tokenization layer on top.