A virtual terminal, and what keying a card really costs.
A virtual terminal is a web page you type card numbers into. It solves a real problem for phone orders and deposits, and every transaction through it is card-not-present — priced higher and carrying the fraud risk.
What this page settles.
Three questions, in the order most people ask them.
What it is
A virtual terminal is a secure web page — usually inside your processor’s or gateway’s dashboard — with fields for a card number, expiry date, security code and billing address. You type a card in, it authorises, and you have taken a payment without any hardware at all.
It is the software equivalent of the old practice of writing a card number on a pad and running it later, except that the number goes straight into the gateway rather than onto paper, which is a considerable improvement. What is a gateway.
Most virtual terminals also offer stored cards through tokenization, simple recurring schedules, emailed receipts, and a transaction history you can refund from.
What it costs, and why
Every transaction through a virtual terminal is card-not-present, and that is not a configuration choice. The card was not physically read, the chip did not authenticate, and the issuing bank has no cryptographic proof the real card was there.
Interchange reflects that. Card-not-present interchange runs roughly 0.3% to 0.5% above the card-present tier on the same card, and the published keyed rates reflect it more sharply still — commonly 3.5% plus a per-item against 2.6% for a tap. Card-not-present downgrades.
On a $200 sale that is a difference of about $1.80. On a shop doing $20,000 a month that drifted into keying 15% of its volume, it is roughly $270 a month for no reason at all.
Which is the thing to check first. If you have a counter and a reader, and a meaningful share of your volume is keyed, something is wrong with the setup — a reader that is awkward, staff who find keying faster, a contactless function nobody enabled. That is a free fix and it is worth more than any rate negotiation. How a card payment works.
When it is the right tool
There are real cases, and in all of them the extra cost is trivial against the alternative of not taking the money.
Phone orders. A customer calls and wants to pay. There is no better option and the cost difference on one sale is cents.
Deposits on work not yet done. A repair shop ordering a part, a salon holding a colour appointment, a contractor taking a deposit. The card-not-present premium is nothing against the cost of a no-show or an unclaimed part. Auto repair processing and salons.
Invoices paid by phone, where a payment link would be better but the customer will not use one.
A backup when the terminal is down. Worth having configured before you need it.
Occasional remote sales for a business that is otherwise entirely in person.
What it is not for is routine volume in a business with a counter.
The fraud problem
The cost is the smaller issue. The liability is the larger one.
In a card-present transaction with a chip read, you have cryptographic evidence the physical card was present. In a virtual terminal transaction you have a number somebody read to you over the phone, and the fraud liability is yours. If the cardholder says they did not authorise it, you will very likely lose. Chargeback reason codes.
Three habits that materially reduce this:
Use AVS and the security code, and act on the result. A mismatched billing address on a high-value phone order is a reason to pause, not a formality to click through.
Be suspicious of the classic pattern: an unusually large order, a rush, a delivery address that differs from the billing address, and a customer who does not want to discuss it. That combination is the oldest card-not-present fraud there is.
Write down what was agreed and keep it. For deposits especially, a written, acknowledged policy is the difference between winning and losing a dispute. How to fight a chargeback.
Doing it properly
Never write the card number down. Not on a pad, not in an email, not in a note in your booking system, not in a spreadsheet of regular customers. Every one of those puts card data in a system you control, which puts you squarely in scope for PCI and gives you something to lose in a breach. Type it straight into the terminal and store the token if you need it again. If card data is breached.
Do not take card details by email or text, and tell customers not to send them. If one arrives, process it and delete the message.
Use tokenization for repeat customers rather than re-keying. Fewer keystrokes, fewer errors, and nothing stored on your side. Tokenization and P2PE.
Settle the same day. A keyed transaction that also settles late has two problems. Batch cutoff times.
Check which SAQ applies. A virtual terminal on a dedicated machine is one of the shorter questionnaires; one on a general-purpose office computer brings more into scope. Which SAQ do I need.
Cheaper alternatives worth trying first
Three things that cost less than keying and solve the same problem.
A payment link. Most gateways will generate a link you text or email; the customer enters their own card on a hosted page. Still card-not-present, but the card data never passes through you, your PCI scope is smaller, and the customer entering their own details is better evidence in a dispute than you typing them.
Tap to pay on a phone. If you can meet the customer, the phone you already own reads a contactless card at card-present rates. For a mobile trade, this converts your most expensive transactions into your cheapest.
ACH for large invoices. Published ACH rates are commonly around 1% with a cap of $5 to $10. On a $5,000 invoice that is $10 against $145 on a card. B2B processing.
What we charge
Interchange + 0.75% + 25¢ keyed, interchange + 0.50% + 10¢ in person, with no contract, no monthly fee and no monthly minimum. A virtual terminal is part of the account rather than a separate monthly line.
The useful thing we usually find on a statement here is not the rate. It is a business with a counter running 10% or 20% of its volume keyed, which is a setup problem worth several hundred dollars a month and takes an afternoon to fix.
While we are on the subject
Is a virtual terminal secure?
The page itself is, and the card data goes to the gateway rather than into your systems. The risk is not technical — it is that you cannot prove the cardholder authorised the sale.
Why do keyed transactions cost more?
Because the card was not physically read, so the issuing bank carries more fraud risk and charges more interchange for it. Roughly 0.3% to 0.5% more.
Can I store a card in a virtual terminal?
Through its tokenization, yes — the gateway stores a token and you never hold a number. Do not write card details down as an alternative.
Do I need a virtual terminal if I have a card machine?
Only if you also take payments where the card is not present. If everything happens at the counter, you do not need one and should not be paying for one.