MOTO (Mail Order/Telephone Order)

Applies to. Applies to merchants that take card details by post or over the telephone and key them into a terminal, a virtual payment terminal or a payment application. The card is never presented, so the channel is governed not by the card-reading device rules in 9.5.1 but by what captures or holds the details: the order form, any call recording, the workstation and application the details are keyed into, and the people doing the keying. A paper form with a PAN on it is stored account data, so the retention and disposal rules in 3.2.1 cover it. The SAQ Instructions and Guidelines list mail/telephone order among the card-not-present channels: SAQ A is written for card-not-present merchants, mail/telephone order or e-commerce, that meet its outsourcing criteria, and SAQ B and SAQ C-VT each state that their merchants may be card-present or mail/telephone order.

Example. A regional tour operator takes bookings by phone. The agent keys the card number and expiry into a virtual payment terminal while the customer is on the line, writes nothing down, and the call recording pauses while the card details are read out. Postal booking forms that arrive with a card number on them are kept in a locked cabinet and shredded once the payment has been authorised and the booking confirmed.

Limits. MOTO is one card-not-present channel, not all of them: e-commerce, where the customer enters their own details on a web page, is a separate channel with its own requirements. MOTO does not put paper out of scope: an order form or a notepad with a PAN on it is stored account data under 3.2.1, and any sensitive authentication data captured while taking the order, such as the card verification code, may exist only until authorisation completes. Nor is MOTO defined by the equipment: keying a card into a countertop terminal because the customer phoned the order in is still a MOTO transaction, and it is the merchant's systems and staff, not the customer's, that are in scope.