Taking card payments in a call centre can be considerably more complicated than simply giving every agent access to a virtual terminal.
Depending on the business, a call centre or contact centre may need a combination of:
- MOTO card processing;
- virtual terminals;
- secure IVR payments;
- agent-assisted IVR;
- payment links;
- recurring-payment functionality;
- CRM or billing-system integration; and
- a merchant account approved for the way payments are actually taken.
The important question is therefore not simply:
“Which payment gateway works for call centres?”
It is:
“What is the safest and most practical payment journey for each type of customer transaction?”
Merchant Advice Service helps businesses understand those requirements before comparing merchant account providers and payment solutions that may fit the organisation.
What Is Call Centre Payment Processing?
Call centre payment processing refers to the technology and merchant-services setup used when customers make payments as part of a telephone-led customer journey.
These payments might relate to:
- telephone sales;
- invoice collection;
- outstanding account balances;
- customer-service calls;
- subscriptions or memberships;
- bookings and reservations;
- deposits;
- insurance or financial-service payments;
- debt collection;
- professional services; or
- high-volume contact-centre operations.
The customer may speak to an agent throughout the process, move temporarily into a secure automated payment journey or make the entire payment through an automated telephone service.
This means there is no single type of call centre payment gateway.
The correct architecture depends on how the business operates.
What Payment Methods Can a Call Centre Use?
There are four main card-payment journeys worth comparing.
1. Virtual terminal and MOTO payments
A virtual terminal allows an authorised employee to enter card information into a secure payment interface.
Where the details are supplied over the telephone, the transaction will normally be processed as a Mail Order / Telephone Order transaction, commonly known as MOTO.
This can work well where telephone payments are relatively low volume or where the customer genuinely needs an agent to process the transaction.
However, at higher volumes the business should consider whether requiring agents to hear and manually enter payment-card information is still the best operational model.
2. Secure IVR payments
IVR payments use Interactive Voice Response technology to allow customers to complete card payments using a telephone.
In a properly configured payment journey, the customer can enter card details using their telephone keypad rather than reading the numbers aloud to an employee.
This can be particularly useful for call centres because the employee does not necessarily need to hear or see the customer's complete card details.
3. Payment links
A call-centre agent can also send the customer a secure payment link by SMS or email.
The customer opens the link and enters their own payment information into a hosted online checkout.
This can be useful where:
- the customer has a smartphone or internet access;
- the agent does not need to remain involved in the card entry;
- the payment needs to carry an invoice or account reference;
- online authentication is desirable; or
- the business wants to reduce the amount of card information handled directly by staff.
4. Automated self-service payments
Some organisations provide customers with a dedicated telephone number that allows them to make a payment without speaking to an employee at all.
The customer may enter:
- an account number;
- invoice reference;
- customer reference;
- payment amount; and
- card information.
The IVR system can then process the transaction and, where suitably integrated, return the result to the business's billing or CRM platform.
This can give customers a payment option outside normal call-centre opening hours.
Call Centre IVR Payments Explained
IVR stands for Interactive Voice Response.
Most people already encounter IVR when calling an organisation and hearing instructions such as:
“Press 1 for sales, press 2 for accounts…”
Payment IVR extends this type of telephone technology into the payment journey.
For call centres, there are two particularly important IVR models.
Fully automated IVR payments
The customer makes the payment without speaking to an employee.
For example:
customer calls payment number → enters customer reference → confirms amount → enters card information → payment processed → confirmation generated
This can work particularly well for repetitive payment journeys such as invoice or account-balance collection.
Agent-assisted IVR payments
Agent-assisted IVR keeps the employee involved in the customer journey without necessarily requiring them to receive the card details.
A typical flow might be:
customer speaks to agent → agent confirms payment amount → customer enters payment details through keypad → payment processed securely → agent receives result → conversation continues
This can be useful where customers need assistance before or after making the payment.
How Can IVR Reduce Card-Data Exposure in a Call Centre?
A major reason businesses investigate secure IVR is to reduce the number of people and systems exposed to raw payment-card information.
With a traditional telephone payment, the customer might read the card number aloud while an employee manually enters it.
That can potentially bring several elements into consideration:
- the employee;
- their computer;
- the telephone environment;
- call recordings;
- screens;
- notes;
- VoIP infrastructure; and
- other connected systems.
A secure IVR or keypad-based payment solution can instead allow the customer to enter the information directly.
Depending on the implementation, technologies such as DTMF masking or suppression can be used so payment-card digits are not exposed through the ordinary call-centre environment.
However, using IVR does not automatically remove a business from PCI DSS scope.
The organisation still needs to understand exactly where payment data travels, which systems interact with it and which responsibilities remain with the merchant.
What Is DTMF Masking?
DTMF stands for Dual-Tone Multi-Frequency — the tones produced when a customer presses buttons on a telephone keypad.
In some secure call-centre payment systems, DTMF masking or suppression technology prevents the agent from identifying the digits being entered.
The customer's keypad entry can instead be passed to the payment environment without exposing the actual card number to the employee.
A properly designed implementation may therefore allow the agent to remain connected to the customer while the card information is entered separately.
This is different from simply muting a recording.
Businesses evaluating DTMF-based payment technology should establish:
- whether agents can hear any of the keypad tones;
- whether card digits appear on the agent's screen;
- whether tones can enter call recordings;
- where the payment information is transmitted;
- which systems remain within PCI DSS scope;
- how failed payments are handled; and
- what happens if the customer cannot use the telephone keypad.
Need a payment setup for a call centre?
Tell us how your customers pay, your expected telephone-payment volumes and whether you need MOTO, IVR, payment links or integration with existing software.
Merchant Advice Service can help you understand the requirement before introducing you to providers that may be suitable.
Get personalised recommendations
Call Recording and PCI DSS
Call recording is one of the most important considerations in a telephone-payment environment.
Many call centres record conversations for:
- training;
- quality monitoring;
- complaint handling;
- regulatory requirements;
- customer-service evidence; or
- operational reasons.
Businesses should not assume those recordings can simply contain complete payment-card information.
Card security codes such as CVV, CVC or CID are classed as sensitive authentication data and must not be retained after payment authorisation.
This includes information captured within audio recordings.
Call centres therefore need to understand how their payment solution interacts with call recording and whether sensitive data is prevented from entering the recording in the first place.
Options can include appropriately configured:
- IVR;
- DTMF masking;
- recording suppression;
- payment links; or
- other secure payment technologies.
The correct solution depends on the complete telephone and payment environment.
Does PCI DSS Apply to Call Centre Payments?
Yes. PCI DSS can apply wherever payment-account data is stored, processed or transmitted.
A call centre therefore needs to consider more than the payment gateway itself.
Depending on the setup, relevant systems can include:
- agent desktops;
- virtual terminals;
- telephone systems;
- VoIP infrastructure;
- call recordings;
- screen recordings;
- CRM systems;
- payment gateways;
- IVR systems; and
- third-party service providers.
The objective should be to minimise unnecessary exposure to payment-card data while still providing customers with a practical way to pay.
A provider advertising a product as “PCI compliant” does not automatically make the merchant's entire call-centre environment compliant.
The merchant should establish what the supplier covers and what PCI DSS responsibilities remain with the business.
IVR vs Virtual Terminal vs Payment Link
| Payment method | Who enters the card details? | Useful for |
|---|
| Virtual terminal / MOTO |
Call-centre agent |
Occasional or agent-led telephone payments |
| Agent-assisted IVR |
Customer through telephone keypad |
Agent-led calls where card-data exposure needs to be reduced |
| Self-service IVR |
Customer through automated telephone service |
Invoices, balances and 24/7 automated collection |
| Payment link |
Customer through online checkout |
SMS/email payment requests and digital customer journeys |
Many larger call centres use more than one method.
For example, an agent might initially offer a payment link, move a customer into secure IVR where telephone payment is preferred and retain a virtual terminal for certain exceptional transactions.
The aim should be to use the payment journey that best suits the customer and transaction rather than forcing every call through the same channel.
Call Centre Payments and CRM Integration
For a large contact centre, taking the payment is only one part of the process.
The transaction may also need to connect with:
- CRM software;
- customer records;
- billing systems;
- accounting software;
- case-management systems;
- booking platforms;
- debt-collection software;
- ERP systems; or
- other back-office applications.
An integrated payment setup can potentially allow the payment result to be returned automatically against the relevant customer, invoice or account.
For example:
agent opens customer account → confirms £240 balance → launches payment → customer enters details securely → payment approved → CRM automatically records £240 payment
This avoids an employee having to manually update several systems after every transaction.
At scale, that operational improvement can be just as important as the payment-processing rate.
What Should a Call Centre Payment Gateway Integrate With?
Before choosing a gateway or payment provider, map the complete payment workflow.
The business may need:
- API access;
- CRM integration;
- webhooks;
- customer-reference fields;
- invoice matching;
- automated reconciliation;
- refund functionality;
- role-based staff permissions;
- multiple departments or teams;
- multiple merchant IDs;
- call-centre reporting;
- recurring payments;
- tokenisation; or
- multiple currencies.
This is why businesses with significant telephone volumes should evaluate the payment platform as part of the wider technology architecture rather than purchasing a standalone virtual terminal and trying to connect everything afterwards.
Remote and Home-Based Call Centre Agents
Remote working can make telephone payments more complicated.
A business may have agents operating:
- from a central office;
- from multiple contact centres;
- from home;
- from overseas locations; or
- through an outsourced call-centre partner.
If employees are receiving card details directly, the organisation needs to understand the security implications of every location and device involved.
A secure IVR or customer-led payment journey can potentially reduce the need for raw card details to enter the employee's working environment.
The merchant should still confirm the actual PCI DSS scope, provider permissions and security requirements for its specific setup.
Are Call Centre Payments MOTO Transactions?
Some are, but not every call-centre payment follows the same route.
Traditional telephone payments where an employee receives card information and enters it into a virtual terminal are normally processed as MOTO transactions.
However, a customer completing an online checkout through a payment link follows a different payment journey.
Likewise, a dedicated IVR payment service may use a different technical flow from a standard agent-keyed virtual-terminal payment.
The acquiring provider therefore needs an accurate picture of how the business expects to take payments.
Do not tell a provider:
“We take online card payments.”
if 80% of the business's turnover is actually being taken by telephone.
Provider underwriting should reflect the real payment channels.
Why Do Providers Assess Call Centres Differently?
The word call centre does not automatically make a business high risk.
However, some call-centre business models can create greater acquiring risk.
A payment provider may therefore look at:
- what the business sells;
- whether calls are inbound or outbound;
- how leads are generated;
- customer locations;
- cardholder locations;
- average transaction value;
- maximum transaction value;
- delivery times;
- refund policies;
- chargeback history;
- telephone scripts;
- MOTO volume;
- processing history;
- where agents are based; and
- how payment information is handled.
This is especially relevant where the business operates in a sector already subject to additional underwriting.
Call centres selling travel, subscriptions, regulated services, high-value products or products delivered significantly after payment may therefore face a different provider assessment from a contact centre simply collecting existing customer invoices.
Chargebacks and Fraud in Call Centre Payments
Card-not-present payments can expose merchants to different fraud and dispute risks from face-to-face transactions.
A call centre should therefore have controls appropriate to its transaction profile.
These may include:
- clear customer records;
- individual employee logins;
- transaction audit trails;
- maximum transaction limits;
- refund controls;
- fraud monitoring;
- clear order confirmation;
- evidence of customer consent;
- delivery evidence where relevant; and
- monitoring of chargebacks.
Moving a customer into a secure IVR or online payment journey can reduce some operational risks, but it does not remove the underlying acquiring risk of the business itself.
Call Centre Payments and Recurring Payments
Businesses collecting subscriptions or regular account payments should not simply re-enter the customer's card details manually every month.
Instead, speak to the payment provider about an appropriate recurring-payment or stored-credential arrangement.
A possible journey could be:
customer completes initial authorised payment → provider creates secure token → customer agrees future payment arrangement → subsequent transactions use the stored credential according to the agreed authority
This can reduce unnecessary repeated handling of raw card information and create a more scalable payment process.
IVR, MOTO or payment links?
You do not necessarily need to choose one.
We can look at how customers currently pay, call volumes, transaction values, existing software and the level of agent involvement before considering which providers and payment methods may fit.
Find suitable payment providers
How Much Does Call Centre Payment Processing Cost?
There is no single call centre payment-processing rate.
Depending on the setup, total costs can include:
- merchant-account transaction charges;
- authorisation fees;
- payment gateway fees;
- virtual-terminal fees;
- IVR charges;
- telephony costs;
- software-platform charges;
- implementation costs;
- integration development;
- PCI-related services;
- international-card fees;
- chargeback charges; and
- support fees.
A low headline transaction percentage does not necessarily mean the cheapest overall call-centre payment solution.
For higher-volume businesses, automation, reconciliation, authorisation performance and reduced manual handling may have a much greater operational value than saving a small amount on one processing fee.
What Should You Compare Between Call Centre Payment Providers?
When comparing providers, look beyond whether they simply offer a virtual terminal.
Payment channels
Can the provider support the required mix of MOTO, IVR, payment links, online payments and recurring transactions?
IVR functionality
Is secure self-service or agent-assisted IVR available?
PCI DSS
How does the solution affect the business's card-data environment and what responsibilities remain with the merchant?
Call recording
How is sensitive card information prevented from entering recordings?
DTMF
Does the solution support suitable keypad masking or suppression where required?
Integration
Can the payment platform integrate with the organisation's CRM, billing or case-management system?
Reconciliation
Can transactions automatically carry customer, invoice and agent references?
Staff controls
Are individual logins, permissions, transaction limits and audit trails available?
Underwriting
Does the acquirer accept the business sector, MOTO volumes, average transaction value and customer geography?
Settlement
How quickly will approved transactions settle?
Commercial terms
What is the total cost once gateway, acquiring, IVR, telephony and platform charges are considered?
The MAS Call Centre Payment Test
Before approaching providers, we suggest mapping seven areas:
Payment Flow → Volume → Security → Agent Exposure → Integration → Underwriting → Provider Fit
Payment flow
What exactly happens between the customer agreeing to pay and the transaction completing?
Volume
How many telephone or remote payments will be processed each day and month?
Security
Where does card information travel and how will it be protected?
Agent exposure
Do employees genuinely need to hear or see the customer's card details?
Integration
Which CRM, billing, accounting or customer systems need the payment result?
Underwriting
Will the acquiring provider support the business sector, payment model and transaction profile?
Provider fit
Which provider can support the complete requirement rather than one isolated part of it?
How Merchant Advice Service Helps With Call Centre Payments
Merchant Advice Service helps businesses understand their payment requirements before comparing providers.
For call centres and contact centres, we can consider areas including:
- merchant accounts;
- MOTO processing;
- virtual terminals;
- secure IVR;
- agent-assisted IVR;
- DTMF payment technology;
- payment links;
- recurring payments;
- CRM integration;
- payment gateways;
- settlement;
- processing costs;
- high-risk underwriting;
- international processing; and
- provider switching.
We are particularly useful where the requirement is more complex than simply accepting an occasional telephone payment.
Merchant Advice Service does not provide IVR software or build call-centre integrations ourselves. Our role is to help the business understand what is required and identify payment providers that may suit the technical, operational and commercial setup.
Businesses can also browse merchant account providers through The Payments Directory®.
Planning or replacing a call centre payment setup?
Tell us how your agents and customers currently make payments and what needs to change.
We can help translate that into requirements around MOTO, IVR, integration, acquiring, settlement and provider suitability.
Get personalised recommendations
Editorial Note
This guide is written and reviewed by Merchant Advice Service to help UK businesses understand call centre and telephone payment processing.
Merchant Advice Service is an independent payment advice and provider-matching service. We are not an acquiring bank, payment processor or PCI assessor, and we do not make final underwriting or compliance decisions on behalf of providers.
Our information, matching and introduction service is free to businesses. MAS may receive commission or a referral fee from some commercial partners where an introduction results in a completed product or account.
PCI DSS scope, merchant-account approval, pricing and technical suitability depend on the individual payment environment and the requirements of the relevant provider.
Sources & References
Merchant Advice Service – IVR Payments UK: Automated Telephone Card Payments Explained
Our guide to IVR payment processing, including automated telephone payments, customer keypad entry and how IVR can fit into a wider remote-payment setup.
Merchant Advice Service – MOTO Merchant Accounts
Further guidance on Mail Order / Telephone Order transactions, provider underwriting and the differences between traditional telephone payments, IVR and other remote-payment methods.
Merchant Advice Service – Pay by Link for Merchants
Explains how payment links can provide an alternative to agent-entered telephone payments by allowing the customer to complete the transaction through a secure online checkout.
Merchant Advice Service – Virtual Terminals for Processing Credit and Debit Cards
More information about virtual terminals and how businesses can manually process approved telephone and remote card transactions.
Merchant Advice Service – Integrated Payments Solutions UK
Guidance for businesses that need payments to connect with CRM, ERP, billing, booking or other operational software.
PCI Security Standards Council – Protecting Telephone-Based Payment Card Data
PCI SSC guidance covering telephone payment environments, call centres, VoIP, IVR and technologies used to reduce exposure of cardholder data.
PCI Security Standards Council – Are audio or voice recordings permitted to contain sensitive authentication data?
Official PCI DSS guidance on call recordings and sensitive authentication data, including card security codes. PCI SSC states that card verification codes must not be stored after authorisation, including within digital audio recordings.
PCI Security Standards Council – Are merchants allowed to request card-verification codes from cardholders?
Official guidance covering CVV, CVC and other card-verification values used in card-not-present and MOTO transactions, including the prohibition on retaining these values after authorisation.
Financial Conduct Authority – Strong Customer Authentication
FCA guidance on Strong Customer Authentication and the security requirements that can apply to electronic payment transactions.
