How to Take Credit Card Payments Without a Card Reader Machine
You can accept credit card payments by hand using card details, phone calls, or online payment links—but each method carries different risks for you and the customer.
If you do not have a card reader machine, you have three main paths: take the card number, expiration date, and security code by hand or phone and process it yourself through a payment processor; use a payment link that the customer clicks to enter their own information; or use a service like Square Cash or PayPal that lets customers pay you directly. The trade-off is always the same: methods that do not require a machine are slower, expose you to fraud, and often cost more in fees than a physical reader would.
The biggest risk is card-not-present fraud. When you physically swipe or insert a card, the machine verifies the card is real and the person holding it owns it. When you take a card number over the phone or by hand, you have no verification. If the card is stolen or the number is fake, you process the payment, the customer's bank reverses it weeks later, and you lose both the money and the goods or service you provided. You are also liable for the chargeback fee, which is usually $15 to $100 per transaction.
Key Takeaways
- Manually entering card details (by phone, email, or in person) exposes you to fraud because there is no way to verify the card is legitimate or that the person using it owns it.
- Payment links and digital wallets like PayPal or Square Cash shift the fraud risk to the payment processor, which has fraud detection built in.
- Processing card details yourself requires a merchant account and payment processor; fees are typically 2.9% plus $0.30 per transaction, higher than swiped cards.
- Keeping card numbers in writing, email, or text creates a data security liability; if your records are breached, you are responsible for notifying customers and may face fines.
- For one-time or occasional payments, a payment link is usually the safest and simplest option; for regular payments, a mobile card reader is cheaper and faster.
Taking Payment by Phone or Hand: How It Works and What Goes Wrong
When you take a card number over the phone or write it down in person, you are asking the customer to read you or show you four pieces of information: the 16-digit card number, the expiration date, the three-digit security code (CVV), and the cardholder's name and billing address. You then enter this information into a payment processor's website or software to charge the card.
This method is called a card-not-present transaction, and it is the highest-risk category for merchants. The customer's bank charges you a higher fee (usually 3.5% to 4% instead of 2.2% to 2.9%) because the bank knows you have no proof the card was authorized by the real owner. If the customer disputes the charge or the card turns out to be stolen, the bank sides with the customer, reverses the payment, and charges you a chargeback fee on top of losing the money.
You also create a data security problem. If you write down card numbers or store them in email, text, or spreadsheets, you are holding sensitive financial data. If your phone, computer, or email account is hacked, that data is exposed. Federal law (the Payment Card Industry Data Security Standard, or PCI DSS) says you cannot store full card numbers this way. Violating it can result in fines from $100 to $100,000 per month, depending on the violation and the payment processor's rules.
Payment Links: The Safest Option for One-Time Payments
A payment link is a URL you send to the customer (by text, email, or in person). The customer clicks the link, enters their card details on a secure page you do not see, and the payment processor handles the transaction. You never touch the card number.
This method moves the fraud risk and data security liability to the payment processor, which has fraud detection software and is required by law to store card data securely. If the transaction is fraudulent, the processor investigates and often covers the loss. You are protected because you have a record that the customer clicked the link and entered their own information.
Services that generate payment links include PayPal, Square, Stripe, and many others. Most charge 2.9% plus $0.30 per transaction for online payments. Some let you customize the link with your business name and logo. The downside is that the customer has to click a link and enter information on their phone or computer, which takes longer than handing you a card, and some customers distrust links sent by text or email.
Digital Wallets and Direct Payment Services
Services like PayPal, Square Cash, Venmo, and Apple Pay let customers send you money directly from their phone or bank account without entering a card number each time. You create an account, share your username or a QR code, and the customer initiates the payment from their own app.
These services are fast and simple for small, informal payments—splitting a bill, paying a contractor, collecting money for a group gift. They are less suitable for a business because the customer is sending you money as a person-to-person transfer, not as a purchase, which means you do not get the same fraud protections or record-keeping that a merchant account provides. Some of these services also flag large or frequent transfers as suspicious and may freeze your account while they investigate.
Fees vary. PayPal and Square Cash charge nothing for transfers between personal accounts but charge 1.5% to 3% if the customer pays with a credit card. Venmo charges no fee for bank transfers but charges 3% for credit card payments. These services are best for occasional payments; if you are running a business and taking payments regularly, a merchant account is more reliable.
Getting a Merchant Account to Process Cards Yourself
If you want to take card payments by phone or mail regularly, you need a merchant account and a payment processor. A merchant account is a bank account that lets you accept card payments. A payment processor is the service that handles the transaction—it charges the card, deposits the money into your merchant account, and handles disputes.
To open a merchant account, you will need to provide the processor with your business name, tax ID, bank account information, and sometimes a processing history or personal credit report. The processor will ask you to sign an agreement that says you understand the risks of card-not-present transactions and agree to their chargeback policy. Most processors require you to keep detailed records of each transaction, including the customer's name, address, and the reason for the charge. If you are sued or charged with fraud, these records are your proof that the transaction was legitimate.
Fees for card-not-present transactions are typically 2.9% plus $0.30 per transaction, though some processors charge a flat monthly fee instead. A few processors offer lower rates if you use their mobile card reader for in-person payments, so if you ever get a reader, your rates will drop.
Keeping Card Data Safe If You Handle It
If you take card numbers by phone or in person, you must never write them down or store them anywhere. The only safe way to handle a card number is to read it once, enter it immediately into your payment processor's website, and then forget it. Do not write it in a notebook, email it to yourself, text it, or save it in a spreadsheet.
If you absolutely must keep a record of the transaction, record only the last four digits of the card, the date, the amount, and the customer's name. This gives you enough information to look up the transaction later if there is a dispute, but not enough for a thief to use the card if your records are stolen.
If your computer or phone is hacked and card data is exposed, you are required by law to notify the customers whose cards were compromised. You must also notify your payment processor and your bank. The notification process is expensive and time-consuming, and it damages your reputation. The simplest way to avoid this is to never store card data in the first place.
Comparing Your Options: When to Use Each Method
| Method | Best For | Fraud Risk | Fee | Speed |
|---|---|---|---|---|
| Payment link (PayPal, Stripe, Square) | One-time or occasional payments; customer is remote | Low (processor handles fraud detection) | 2.9% + $0.30 | 2–5 minutes |
| Digital wallet (PayPal, Square Cash, Venmo) | Small informal payments; customer has the app | Low (processor handles fraud detection) | 0–3% depending on payment method | 1–2 minutes |
| Phone or hand entry with merchant account | Regular business payments; you need detailed records | High (you verify nothing; you liable for chargebacks) | 2.9% + $0.30 or flat monthly fee | 5–10 minutes |
| Mobile card reader (Square, PayPal, Clover) | In-person payments; customer is present | Very low (card is verified by reader) | 2.2% + $0.10 | 1–2 minutes |
What Happens If a Payment Is Disputed
If a customer claims they did not authorize a charge or that the card was stolen, the card issuer (the customer's bank) opens a dispute called a chargeback. The bank freezes the money, investigates, and decides whether to return it to the customer or send it back to you.
If you took the payment by hand or phone, you have almost no proof that the customer authorized it. You can provide a receipt with their signature or a recording of the phone call, but these are weak evidence. The bank usually sides with the customer, reverses the charge, and charges you a chargeback fee ($15 to $100). If you get too many chargebacks (usually more than 1% of your transactions), the processor can close your account.
If you took the payment through a payment link or digital wallet, the processor has a record that the customer clicked the link or initiated the payment from their own account. This is stronger evidence. The processor will defend you in the dispute, and if the bank rules against you, the processor often covers the loss instead of charging you the full chargeback fee.
Frequently Asked Questions
Can I take a credit card payment over email?
You can ask the customer to email you their card details, but you should not do this. Email is not encrypted, so the card number travels across the internet in plain text where hackers can intercept it. Instead, send the customer a payment link they can click to enter their details on a secure page. This is safer for them and protects you from liability if the email is hacked.
What if the customer's card is declined?
If the card is declined when you enter it into the processor, the transaction does not go through and you do not charge the customer. Ask them for a different card or payment method. Do not try the same card multiple times in a row; each attempt is a separate transaction and multiple declines can trigger fraud alerts on the customer's account.
Do I need to keep receipts for card payments I take by hand?
Yes. Keep a record of the date, amount, customer name, last four digits of the card, and what the payment was for. If there is a dispute later, this record is your proof that the transaction happened. Do not keep the full card number. Your payment processor will also keep a record on their end, so you can look it up if you need to.
What is the difference between a payment link and a digital wallet?
A payment link is a one-time URL you send to a specific customer for a specific payment. A digital wallet is an app the customer uses repeatedly to send you money whenever they want. Payment links are better for business transactions; digital wallets are better for informal or ongoing payments between people.
If I use a payment link, do I still need a merchant account?
No. The payment link service (PayPal, Stripe, Square) acts as your merchant account. They handle the fraud detection, store the card data securely, and deposit the money into your bank account. You just need a regular business or personal bank account to receive the deposits.