MOTO Credit Card Processing for Service Businesses: Compliance and Fraud Prevention

A MOTO merchant account is generally most useful for service-based companies that take payments over the phone. This can include companies that have appointments, take deposits, have repeat customers, have to take emergency calls, or issue invoices to customers. The way the company bills its customers and fulfills those bills is just as important as the kind of company it is in the industry. Therefore, if phone calls are used to take orders or receive payments from customers, a MOTO merchant account can be useful for those companies.

For companies that already have a system in place for customers to take payments online in a self-serve manner, however, it may be more beneficial to use the MOTO merchant account as a backup channel rather than as a main channel for taking payments from customers.

The right choice depends on volume, staff process, and how much payment data your environment can safely handle. PCI SSC’s telephone-payment guidance and SAQ C-VT materials make clear that the compliance impact changes significantly depending on whether you are using an isolated virtual terminal, handling recordings, or using more advanced masking controls.

There is no set timeline for a MOTO merchant account, as the provider considers your business category, payment method, phone ordering process, website disclosures, and your ability to handle fraud and chargebacks. Braintree specifically states that merchant account providers collect as much information as possible about a business during onboarding to ensure they are financially liable for any losses the business incurs.

The most common causes of delays in obtaining a merchant account are preventable. If a business cannot explain to the merchant account provider how phone payments are taken, how they avoid storing card data, or how they manage chargebacks, there will be delays in getting the account approved. The smoother and more efficient the MOTO processes are for a business, the less friction it will encounter when trying to get a merchant account approved.

For most service businesses, the typical business and owner documentation will be requested. For MOTO businesses, additional documentation will be requested for the payment process over the phone, the recording of those calls, the virtual terminal software to be used, and security measures for card data entering the system. Each of these documents is a result of PCI scope and the company’s underwriting for which the MOTO provider will be providing card sales.

In addition to the typical documentation for a business, the MOTO company will also need to provide documentation on its services and products, refund policies, company contact information, and the timing of customer charges for products or services. If the company plans to save customers’ cards for future charges, that will also need to be explained to the MOTO provider.

Before going live with MOTO payment processing, most service businesses will be able to say yes to the following compliance questions:

• Do we use a real virtual terminal or workflow that accepts payments over the phone?
• Are phone calls recorded, and is customer payment information stored in those call recordings?
• Does our business require a SAQ C-VT form or a broader SAQ form?
• Do our staff members collect customer verification data during each transaction?
• Can we easily associate a refunded or canceled service with the payment method used?
• Do we use saved card billing, and if so, do we have a process and customer consent to use this function?

There is no single price for MOTO payment processing. Because Moto transactions are considered card-not-present, the business’s cost typically factors in the risk and fraud costs associated with those transactions. This is one of the reasons service industries often find that phone transactions cost more than card-present transactions at the point of sale.

The real question is not what the pricing for moto transactions will be before the fraud and charge return risks are factored in, but rather what the cost of the process will be after those costs are considered. A process that seems convenient for MOTO transactions may end up costing the business more when fraud, chargebacks, and security compliance are factored in than an alternative process for establishing MOTO sales.

The most common mistake is treating the phone as a shortcut. Business owners often write down card details, which can end up in the recording files or allow their representatives to improvise the verification process. The PCI SSC has guidance regarding telephone payments for this very reason.

Another common mistake is treating authorization as the end of the road. For MOTO, the real world can pose challenges during the fraud and charge dispute phase. If you cannot present proof of the customer’s agreement to the service and payment, when the service was authorized, and how the payment was made, then you will be on the defensive with that transaction.