Taking payment for phone orders without asking for the card: payment links and remote POS

A customer calls, knows what they want, does not feel like wrestling with the website and says: “I'll give you my card details”. In many stores the response is to grab a pen and paper. It is the quickest option and also the riskiest: you now have the full details of a card on a note, in an email or in a spreadsheet, and they should not be anywhere in your business.

Let's look at why you should avoid it and what alternatives there are for taking payment for phone orders without ever touching the card.

Why you should not write down the card

• The card security standard (PCI DSS) requires anyone who stores, processes or transmits card data to protect it with strict controls. A number written on paper or in an email meets none of them. Moreover, the security code must not be stored after authorisation.
• If your computer or email account is stolen, those cards go with it. With malware that steals credentials from computers, this is not an unusual scenario.
• The fraud falls on you. A payment you key in without the cardholder authenticating is one where you have little defence if the cardholder says they did not make it.
• Staff see data they do not need. The fewer people who see a card, the better.

The alternative: let the customer pay themselves

The idea is simple: you prepare the order and the customer pays for it from their phone or computer, authenticating with their bank. There are several ways to do this.

Payment link

You generate a link with the amount and send it by email, SMS or WhatsApp. The customer opens it, pays by card or another method, and you receive the confirmation. Almost all gateways offer some form of payment link. Advantages: you do not see the card, the customer authenticates and you have proof of payment. Drawback: if the link is not tied to an order in the store, you then have to create the order manually and reconcile it.

Prepared cart

Better than a standalone link: you build the cart in the store with the agreed products, quantities and discounts, and send the customer a link so they can open it and pay through the normal checkout. The order is created automatically, with its invoice, stock and tracking. It is the same idea as a quote that gets paid.

Order created from the back office with payment pending

PrestaShop lets you create orders from the back office on behalf of the customer. You can create it with a method such as bank transfer or pending payment and then send them the way to pay. This is useful for business customers who pay by bank transfer, less so for consumers who want to pay by card there and then.

The phone price must be the website price

A common problem in stores that also sell by phone or over the counter: the price quoted does not match the one on the website. The staff member looks at one price list, the customer sees another in the online store, and one of them gets a surprise. This happens above all with:

• Customers with their own price list per group (trade, distributors).
• Specific prices per product or per customer.
• Automatic cart rules and active vouchers.
• Shipping costs that depend on the carrier, the weight and the destination.
• VAT according to the country of the address.

If the order is paid with a cart from the store itself, all of that is applied automatically. If it is charged from a separate POS or management program, that program needs to read the store's prices, not keep its own copied by hand.

What distance selling requires

A phone order from a consumer is a distance sale, with the same obligations as a sale on the website: pre-contractual information, the right of withdrawal and confirmation on a durable medium. For telephone sales, Spanish consumer protection law adds that you must confirm the offer in writing and that the consumer is only bound once they also accept it in writing. An email with the order summary that the customer accepts when paying via a link covers this well; a payment keyed in by you with nothing in writing does not.

At the start of the call, if you record it, say so. And if you quote prices, they should include VAT for consumers, just as on the website.

A procedure for the team

1. Identify the customer and look up their account in the store. If they do not have one, create it or use their email.
2. Prepare the cart or order in the store, with its terms.
3. Send the payment link and, in the same message, a summary of what they are buying, shipping costs and delivery time.
4. Do not ship anything until the payment is confirmed by the gateway, not by a screenshot from the customer.
5. Never write down a card. If the customer insists on reading it out, explain that it is for their own security.

And, as always when money is involved, keep the gateway and payment modules up to date: old integrations are the ones that stop working when the gateway changes its requirements.

How to do it in PrestaShop

If the phone order is taken from a POS or an ERP, RKR Remote TPV Lite gives that program the PrestaShop catalogue through a JSON endpoint: categories, products, combinations, prices, stock and warehouse locations. Its basket pricing action takes a basket and a customer and returns what they would pay buying on the website, with their group discount, their specific prices, cart rules, vouchers, the VAT of their country and the shipping costs of each carrier. That way the price you quote by phone or over the counter is the same as the store's. Access is protected with a regenerable token and a list of authorised IP addresses. It is a connection for developers: the POS or ERP has to make the calls.