How a MOTO payment works
An agent takes the card number, the expiry date and the security code and types them into a virtual terminal, a web page provided by the gateway or the acquirer. The payment is flagged as mail or telephone order and sent for online authorisation.
The Visa Core Rules of 18 April 2026 define a mail/phone order as a purchase in a card-absent environment where the cardholder orders by telephone, mail or other means of telecommunication. Mastercard's Transaction Processing Rules of 9 June 2026 call manual key entry of the card number the normal method, require online authorisation and state that there is no cardholder verification procedure for these transactions (5.2).
MOTO and strong customer authentication
In the EU, PSD2 requires strong customer authentication for electronic payments that the payer initiates (Article 97). Recital 95 of the directive says there does not seem to be a need to guarantee the same level of protection to payments initiated and executed other than through electronic platforms or devices, and names mail orders and telephone orders.
A MOTO payment therefore normally goes through without 3-D Secure, and with no authentication there is no liability shift to rely on in a fraud dispute. The MOTO flag is not a route around authentication for online sales: a payment that the buyer keys in on a website is an electronic payment.
What MOTO means for a merchant's security
Card details pass through staff, telephones and sometimes call recordings, all of which count towards the merchant's PCI DSS scope. Call centres reduce that exposure with keypad entry that hides the digits from the agent, or by sending the caller a payment link.
MOTO, e-commerce or a payment link?
- E-commerce payment
- The buyer types the card details into a checkout and can be authenticated with 3-D Secure.
- Payment link
- The agent sends a link and the buyer pays in a hosted checkout, as an authenticated online payment.
Where a MOTO payment shows up in a platform
Modules that do the work
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, Article 97 and recital 95 (EUR-Lex)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, Mail/Phone Order (Visa)
- Mastercard Transaction Processing Rules, 9 June 2026: 5.2 (Mastercard)
General information, not legal advice: what applies to you depends on your services and your market.