Mail Order/Telephone Order (MOTO)

Mail order/telephone order (MOTO) is a category of card payment in which the cardholder provides card details to a merchant remotely, by telephone, post, fax or a similar channel, and the merchant enters the details into a terminal or payment system on the customer's behalf. Hotels taking bookings by phone, call centres selling insurance or travel, charities taking donations over the phone and catalogue retailers all process MOTO payments. The cardholder never presents the card to the merchant and does not enter any details into the payment system themselves.

MOTO is a form of card-not-present transaction, alongside e-commerce. Card networks require merchants to identify MOTO payments correctly in the authorisation message, because the risk profile, the fraud rules and the authentication requirements differ from those of in-person and online purchases. Merchants usually need specific permission from their acquirer to take MOTO payments.

The merchant collects the card number, expiry date and, normally, the card verification code printed on the card, together with the cardholder's name and billing address. The details are keyed into a terminal set to manual entry, or more often into a virtual terminal provided by a payment gateway. The transaction is sent for authorisation with a MOTO indicator, and the issuer approves or declines it in the usual way.

Address checks, where available in the market, compare the billing address given by the caller with the address the issuer holds. Some businesses also use MOTO to store a card for later charges, in which case later payments are treated under the rules for card-on-file transactions.

In the European Economic Area and the United Kingdom, rules made under the Second Payment Services Directive (PSD2) require strong customer authentication for most electronic payments initiated by the payer. MOTO transactions are treated as outside the scope of this requirement, because the payer does not initiate the payment electronically. As a result, MOTO payments are not authenticated with 3-D Secure.

This exclusion is sometimes misused. Merchants that flag ordinary online orders as MOTO to avoid authentication break network rules and can face penalties, and issuers monitor for unusual MOTO patterns.

Because there is no chip, PIN or authentication, MOTO transactions carry more fraud risk than face-to-face payments. A criminal with stolen card details can phone a merchant and place an order. Under card network rules, the merchant generally bears the loss if a MOTO transaction is later disputed as fraud, since there is no liability shift of the kind that 3-D Secure provides online. Disputes are raised through the chargeback process.

Merchants reduce this risk in several ways:

• Verification checks. Using the card verification code and address checks for every order.
• Order review. Looking for warning signs such as mismatched delivery and billing addresses, rush delivery requests or several cards tried in one call.
• Call-back procedures. Calling the customer back on a known number for high-value orders.
• Payment links. Sending the customer a secure link so that they complete payment online with authentication, which turns the payment into e-commerce rather than MOTO.

Staff training also matters, because social engineering is common in telephone fraud: callers may claim urgency, offer to pay extra for quick dispatch or ask for goods to be sent to a third party.

MOTO payments create particular data security challenges. Card details spoken over the phone can be overheard, written down or captured in call recordings. Under the Payment Card Industry Data Security Standard (PCI DSS), the card verification code is sensitive authentication data that must not be stored after authorisation, which includes recordings. Call centres therefore pause recordings during payment, or use telephone keypad entry with tone masking so that the agent never hears or sees the card number. These techniques also reduce the scope of the merchant's PCI DSS assessment.

MOTO remains important in sectors where customers prefer to talk to someone, such as travel, hospitality, utilities and charities, and among older customers. Its share has fallen as merchants move telephone customers to payment links and online checkouts, which offer authentication and lower fraud. Merchants that keep MOTO are typically assigned a specific merchant category code and pricing, and acquirers often charge higher rates for MOTO than for card-present payments because of the greater risk of friendly fraud and third-party fraud.