Virtual terminals in the UK

A virtual terminal is a secure web page in your acquirer or payment-provider dashboard where you key in a customer’s card details yourself, on their behalf, to take a payment. There is no card machine and no customer-facing checkout. It is used for telephone and mail orders (known as MOTO, Mail Order / Telephone Order), so the customer does not need to be present or online.

No. A virtual terminal runs entirely in a web browser. You only need an internet connection and a device to log in on. That is the main difference from a card machine (which needs a physical terminal) and from an online payment gateway (which needs a checkout integrated into your website).

Two parts: the platform cost and the per-transaction rate. Square’s Virtual Terminal is free with no monthly fee and charges 2.5% on keyed-in payments. Stripe charges manually-entered payments at roughly its standard online rate. Acquirer-backed virtual terminals (Worldpay, Elavon, Paymentsense) are usually on a monthly contract with rates quoted per account. Keyed-in (MOTO) rates are always higher than chip-and-PIN because the card is not present.

The provider’s virtual terminal page is PCI-DSS compliant, but how you use it affects your own scope. Keying card numbers into a hosted virtual terminal usually keeps you in the lighter SAQ-C-VT category, provided you never write card numbers down, store them, or take them over a recorded line without pausing the recording. Never email or message card details to yourself to key in later.

The merchant. MOTO and keyed-in payments are card-not-present, so there is no chip-and-PIN or 3D Secure authentication to shift liability to the card issuer. If a keyed payment turns out to be fraudulent or is charged back, the loss usually falls on you. This is the main risk to weigh against the convenience, and the reason keyed rates are higher.

A payment link sends the customer a URL to pay themselves, so the card details are entered by the cardholder and the transaction can carry 3D Secure authentication, which shifts fraud liability to the issuer. A virtual terminal has you key the details in, which is faster on a live phone call but leaves fraud liability with you. For most phone orders a payment link is the safer default; a virtual terminal suits repeat B2B customers and situations where the customer cannot use a link.

Some virtual terminals let you save a card on file for repeat charges, subject to the customer’s consent and the scheme rules on stored credentials. This is common for B2B accounts and subscriptions billed by phone. Check the provider supports card-on-file and that you capture the customer’s authorisation, as keying a stored card still counts as card-not-present.