Mail order / telephone order (MOTO)

Mail Order / Telephone Order (MOTO) is a card-not-present transaction initiated by a merchant operator rather than the cardholder. It covers phone bookings, written mail orders, and call-centre payments — any situation where a staff member collects payment details on behalf of a customer who is not interacting with a payment terminal or checkout page. VINR supports three MOTO paths: direct API submission, a browser-based virtual terminal in the dashboard, and manual key entry on a physical terminal. Choose the path that matches your PCI scope and operational setup.

MOTO via APIAskCopy

When your staff collects card details verbally — over the phone or from a written order form — your server can submit those details directly to the VINR Payments API. Set moto: true on the payment to flag it as a card-not-present MOTO transaction. VINR applies the correct interchange category and bypasses 3DS (see 3DS and authentication).

import { Vinr } from '@vinr/sdk';

const vinr = new Vinr({ secretKey: process.env.VINR_SECRET_KEY });

const payment = await vinr.payments.create({
  amount: 9900,
  currency: 'GBP',
  moto: true,
  paymentMethod: {
    type: 'card',
    card: {
      number: '4111111111111111',
      expMonth: 12,
      expYear: 2027,
      cvc: '123',
    },
  },
  billingDetails: {
    name: 'Jane Smith',
    address: {
      line1: '14 Regent Street',
      city: 'London',
      postalCode: 'SW1Y 4PH',
      country: 'GB',
    },
  },
  reference: 'order_3821',
});

MOTO via virtual terminalAskCopy

The Virtual Terminal is a browser-based card form hosted entirely by VINR. Your staff opens Operations → Virtual Terminal in the VINR dashboard, enters the cardholder's details, and submits the payment. Raw card data is entered into VINR's page — your network and systems never touch it.

Because raw card data never touches your systems, the Virtual Terminal path reduces your PCI scope to SAQ-A. Use it when:

• You lack the infrastructure to meet SAQ-C requirements for the API path.
• Your call-centre staff already work in a browser environment.
• You want supervisory controls (role-based access, audit log) without custom integration work.

Use the API path instead when you need to embed MOTO processing inside a proprietary CRM, telephony platform, or order management system.

MOTO via terminal key entryAskCopy

On a VINR terminal, staff can manually enter a card number on the physical keypad when the customer is not present to tap or insert. This is known as manual key entry. See In-person features — manual key entry for the full terminal walkthrough.

3DS and authenticationAskCopy

MOTO transactions are explicitly excluded from Strong Customer Authentication (SCA) requirements under PSD2 Article 18. Because the cardholder is not present to authenticate, 3DS cannot be applied. VINR automatically marks API payments with moto: true as out-of-scope for 3DS and does not request an authentication challenge.

Reducing fraud riskAskCopy

Card-not-present fraud is more common in MOTO than in card-present channels. Apply as many of these controls as your volume justifies:

• AVS (Address Verification Service) — pass billingDetails.address on every MOTO payment. VINR returns an avsResult code on the payment object. Decline or flag payments where the postcode or full address does not match.
• CVC check — always collect and submit the CVC. VINR returns a cvcResult code. A no_match result is a strong fraud signal.
• Velocity limits — configure per-card and per-IP velocity rules in Operations → Fraud prevention to block rapid repeat attempts with the same card number.
• Shipping-address match — for physical goods, compare the shipping address against the billing address. A significant mismatch warrants manual review before fulfilment.
• Tokenize repeat customers — for customers who order regularly by phone, complete an initial MOTO charge and save a reusable token. On subsequent calls, staff look up the customer record; you charge the token without re-collecting card details. See Tokenization.

MOTO-specific field referenceAskCopy

Next stepsAskCopy