Virtual Payment Terminal
PCIComplianceHubLast updated
A web page, provided by an acquirer, processor or other third party, into which a merchant types a customer's card details by hand to authorise a transaction. No card is read; the merchant is the one entering the data. It is the arrangement SAQ C-VT is written for.
Applies to. Merchants that take card-not-present payments by keying them in, typically phone and mail orders in low volumes, and that want the SAQ C-VT route.
Example. A florist takes orders by phone and types each card into the processor's web terminal on a dedicated computer that is used for nothing else and connects to nothing else in the shop.
Limits. Eligibility for SAQ C-VT turns on isolation: a single dedicated device, in one location, connected to no other system or premises, keying one transaction at a time, with no electronic storage of account data. The same web terminal used from a laptop that also handles email is not that. Because the merchant types the PAN, the merchant is handling account data, which is why the questionnaire is longer than SAQ A.