You can accept credit cards through manual entry, phone calls, online payment links, and digital wallets—each with different fraud protection and processing times
If you don't have a card machine, you have several working options. The most common are keyed entry (you type the card number into a payment processor), phone-based processing (the customer calls a number or you call them), payment links (you send a URL and they enter their own details), and digital wallets like Apple Pay or Google Pay (which work on any smartphone). Each method has different fraud protections, different costs, and different timelines for the money to reach your account.
The trade-off is always the same: methods that are easiest to set up offer less fraud protection and may cost more per transaction. Methods that are safer take longer to set up or require the customer to do more work. Your choice depends on how much fraud risk you can absorb, whether you're taking one payment or many, and whether your customers are in person or remote.
Key Takeaways
- Manual card entry (keyed transactions) works through any payment processor and costs 1 to 3 percent more per transaction than swiped cards because fraud risk is higher.
- Payment links let the customer enter their own card details on a secure page, which shifts fraud liability to the processor and is the safest option for remote payments.
- Phone-based processing requires you to read the card number aloud or have the customer read it to you, and chargebacks are common because there is no signature or PIN.
- Digital wallets (Apple Pay, Google Pay, PayPal) work on any phone and offer fraud protection, but require the customer to have the app and a compatible phone.
- All methods except digital wallets require you to keep the card number secure or not keep it at all, which means using a PCI-compliant processor and never storing raw card data yourself.
Manual card entry through a payment processor
This is the simplest option if you already use a payment processor like Square, Stripe, PayPal, or your bank's merchant account. You log into the processor's website or app, enter the card number, expiration date, and CVV manually, and process the payment. The customer does not need to be present, and you do not need any hardware.
The cost is higher than a swiped transaction. Most processors charge 1 to 3 percent more per transaction for keyed entry because the fraud risk is higher—without a physical card or a PIN, the processor has less proof the cardholder authorized it. Some processors call this a "card-not-present" fee or simply charge a higher percentage for manual entry. Check your processor's pricing page or call them to confirm the exact rate.
Chargebacks are more common with keyed entry. If the customer disputes the charge later, the burden is on you to prove they authorized it. You have no signature, no PIN, and no physical card to show. Keep an email, text, or order confirmation that shows the customer asked for the charge. Without that, you will likely lose the dispute and have to refund the money plus a chargeback fee (usually $15 to $100).
Payment links and hosted payment pages
A payment link is a URL you send to the customer. They click it, enter their card details on a secure page hosted by your processor, and the payment goes through. You never see or handle the card number. This is the safest option for remote payments and the one processors prefer because it shifts fraud liability to them.
Most payment processors offer this for free or as part of their standard plan. Square, Stripe, PayPal, and Shopify all let you generate a payment link in seconds. You can customize the amount, add a description, and set it to send an automatic receipt. Some processors let you embed the payment form directly on your website instead of sending a link.
The customer enters their own details, which means fewer data entry errors and less fraud risk on your end. If a chargeback happens, the processor's fraud data (IP address, device fingerprint, velocity checks) helps prove or disprove the claim. You still need to keep records of the order or invoice, but you do not need to store the card number itself.
The downside is that the customer has to take an extra step. Some will abandon the payment if the link is confusing or if they do not trust the page. Test the link yourself before sending it, and include clear instructions in your message.
Phone-based card processing
You can process a card payment over the phone in two ways: the customer reads their card details to you, or you call them and they read the details to you. Either way, you enter the information into your processor and charge the card.
This works with any processor that supports keyed entry, so there is no special setup. The customer does not need internet access or a smartphone. It is fast if the customer is already on the phone with you.
The fraud risk is very high. There is no signature, no PIN, no way to verify the customer is who they say they are. Chargebacks are common because the customer can claim they never authorized the charge. You have only your word and possibly a recording (which is legal to make in most states but illegal in others—check your state law before recording). Even with a recording, you may lose the dispute if the customer's bank decides the call was coerced or if the customer claims identity theft.
If you must use phone processing, get written confirmation after the call. Send an email or text to the customer's phone number on file, summarizing the charge and the card ending in X digits. Ask them to reply confirming they authorized it. Keep that confirmation. It is not perfect protection, but it is better than nothing.
Digital wallets and mobile payment apps
Apple Pay, Google Pay, Samsung Pay, and PayPal all let customers pay by tapping or scanning their phone. If you have a smartphone, you can accept these payments using a free app like Square Cash, PayPal, or your processor's mobile app. The customer taps their phone to yours (or scans a QR code), and the payment goes through.
The fraud protection is strong. The customer's actual card number is never shared with you. The payment is encrypted and verified by the customer's bank or digital wallet provider. Chargebacks are rare because the bank has proof the customer initiated the payment from their own device.
The limitation is that the customer must have the app installed and a compatible phone. Older phones, basic phones, and some international phones do not support digital wallets. You still need internet access on your phone to process the payment, and the transaction takes a few seconds to complete.
The cost is usually the same as a swiped card (around 2.6 percent plus $0.10 per transaction for most processors), sometimes lower. Money typically reaches your account in 1 to 2 business days.
What happens to the card number after you process it
If you manually enter a card number, you must never store it. Do not write it down, do not email it, do not save it in a spreadsheet. Your processor stores it in an encrypted vault, and you should have no copy of it. This is required by the Payment Card Industry Data Security Standard (PCI DSS), which applies to anyone who handles card data.
If you violate this rule and a breach happens, you are liable for the costs: forensic investigation, notification letters, credit monitoring, fines from the card networks, and lawsuits from customers. The fines alone can reach thousands of dollars. It is not worth it.
Use payment links whenever possible because you never touch the card number. If you must do manual entry, use a processor that is PCI-compliant and never store the data yourself. If you are unsure whether your processor is compliant, ask them directly. They should be able to show you their PCI certification.
Comparing costs and timelines across methods
| Method | Cost per transaction | Setup time | Fraud risk | Chargeback rate |
|---|---|---|---|---|
| Manual card entry | 2.9% + $0.30 to 3.5% + $0.30 | Minutes (if you have a processor) | High | Higher |
| Payment link | 2.6% + $0.10 to 2.9% + $0.30 | Minutes | Low | Lower |
| Phone processing | 2.9% + $0.30 to 3.5% + $0.30 | Minutes | Very high | Highest |
| Digital wallet | 2.6% + $0.10 to 2.9% + $0.30 | Minutes (if you have a smartphone) | Very low | Lowest |
Money reaches your account in 1 to 2 business days for all methods, though some processors offer next-day or same-day deposits for an extra fee. Check your processor's settlement schedule.
Choosing the right method for your situation
If you take payments in person and have a smartphone, use a digital wallet. It is the safest and cheapest option, and most customers expect it.
If you take payments remotely (phone, email, online), use a payment link. Send the customer a URL, they enter their own details, and you never handle the card number. This is the safest option for both of you.
If the customer insists on giving you their card number over the phone, use manual entry through your processor and follow up with a written confirmation email. Do not write down the number or store it anywhere. Accept that chargebacks are more likely and budget for them.
If you do not have a processor yet, sign up for one that supports all these methods. Square, Stripe, PayPal, and most banks offer free or low-cost accounts. Compare their per-transaction fees and settlement times, then pick the one that fits your volume and speed needs.
Frequently Asked Questions
Can I accept credit cards without a processor account?
No. Every method requires a processor to handle the payment securely and deposit the money into your bank account. You cannot legally accept and store card numbers on your own. Sign up for a free account with Square, Stripe, or PayPal—it takes 10 minutes.
What if a customer disputes a charge I processed manually?
The burden is on you to prove they authorized it. Keep an email, text, or order confirmation showing the customer requested the charge. Without written proof, you will likely lose the dispute and have to refund the money plus a chargeback fee. Payment links are safer because the processor has its own fraud data to defend the charge.
Is it safe to write down a credit card number?
No. Never write down, photograph, or email a card number. It violates PCI compliance rules and exposes you to fines and liability if the number is stolen. Use a payment link or let your processor store the number in its encrypted vault. You should have no copy of it.
Do digital wallets work with all phones?
No. Apple Pay works on iPhones and Apple Watches. Google Pay works on Android phones. Samsung Pay works on Samsung phones. Some older or basic phones do not support any digital wallet. Always have a backup method (payment link or manual entry) for customers whose phones do not work.
How long does it take to get the money after I process a payment?
Most processors deposit money in 1 to 2 business days. Some offer next-day or same-day deposits for an extra fee. Check your processor's settlement schedule. Weekends and holidays may delay deposits by a day.