Phone and email orders keep revenue moving for merchants who sell from a catalogue, take repeat business from long-standing accounts, invoice commercial customers, or simply serve people who would rather talk to a human than fill out a checkout form. That convenience wins sales. It also opens a door that fraudsters walk through every single day. Keyed payments carry no chip, no PIN and no customer standing at the counter, so when stolen card data is used successfully, the loss usually lands on the merchant — along with the chargeback fee, the lost inventory and the shipping cost. The reassuring part is that most card-not-present fraud is preventable. It rarely requires advanced technology; it requires disciplined habits around the phone, a few verification steps at the point of entry, and tools that keep card data out of sticky notes, spreadsheets and email threads.
Why Phone and Email Orders Attract Fraud — and the Red Flags Worth Memorizing
Fraudsters gravitate to phone and email channels for practical reasons. There is no physical card to inspect, no signature to compare and no clerk standing two feet away who might notice that the name on the card does not match the person holding it. A fraudster can apply real-time social pressure on a call — sounding confident, name-dropping a manager, claiming a deadline — and many front-line staff are trained to be helpful rather than suspicious. Email adds another layer of risk because it can be spoofed, forwarded, harvested and automated, which makes it a favourite vehicle for fake supplier invoices and last-minute requests to change banking details.
Certain patterns repeat often enough to be worth memorizing. Urgency is the single most reliable tell: a caller who needs the order shipped today, who cannot wait for a verification call, or who pushes back hard when asked a routine question. Watch for orders that are unusually large for that customer or that product line, especially when the request is for bulk quantities of goods that resell easily. A mismatch between the billing address, the shipping address and the area code the caller is dialling from deserves a second look, as does a high-value order placed from a free email domain with a generic name attached to it. Other signals include a caller who offers a second and third card after a decline, who refuses to provide a callback number, who asks that no receipt be emailed, who insists the parcel be left without a signature, or who sends a message with the full card number typed into the body — which is both a red flag and a serious compliance problem.
Email-specific fraud deserves its own attention. A message that appears to come from an existing supplier, announcing updated bank details and asking you to pay an outstanding invoice immediately, is one of the most common and most expensive scams in business today. So is the “customer” who emails a large order and asks you to charge a card you have never seen, then requests that the goods go to a different address than the one on file. Treat any instruction that changes where money goes — a new bank account, a new payee, a new remittance email — as a fraud attempt until it has been verified out loud with a person you already know.
Verification That Actually Works — Before You Key a Single Digit
A common question from owners setting up keyed payments for the first time is, “Can I accept credit cards by phone or email securely?” The answer is yes, but only if the card number is treated the way you would treat cash sitting on the counter. Card details should be keyed directly into a secure, browser-based virtual terminal and never written on paper, pasted into a CRM note, forwarded in an email or stored in a shared spreadsheet. Emailed card numbers travel through servers you do not control and sit in inboxes indefinitely; they should be refused politely and replaced with a callback or a secure payment link. A virtual terminal built for phone, mail and email orders — like the one RapidCents provides — keeps the card data inside a controlled environment and issues the receipt by email automatically, so nobody has to transcribe anything.
Verification should be layered rather than theatrical. Address Verification System checks and CVV checks cost nothing extra at the point of entry and catch a meaningful share of mismatched data. Where 3-D Secure is supported, it shifts liability for qualifying transactions and adds a step that a fraudster holding only a card number cannot easily complete. Beyond the technology, pick up the phone: call the customer back on a number you source independently — from a directory, a website or your own records — never on the number the caller supplied. A genuine customer will not mind a two-minute confirmation for a first order or a high-value purchase; a fraudster usually will.
Set thresholds, in writing, for when a transaction needs a manual review: first-time buyers above a certain amount, orders shipping to an address that differs from the billing address, and anything that feels rushed. For unknown or unusually large purchases, a branded payment link with an expiry date and a locked amount is often the cleanest solution, because the customer completes the transaction themselves and the card data never touches your staff. For repeat customers, tokenization and a secure card vault let you charge a saved card for reorders and recurring schedules without anyone re-keying a sixteen-digit number over the phone. Verification is not about distrusting customers; it is about making certain that the person paying is the person you are shipping to.
Locking Down People, Records and Disputes So Fraud Cannot Slip Through
Tools only work when the people using them have clear boundaries. Restrict key-entry, refund and void permissions by role so that the person taking an order is not automatically the person who can reverse a charge, and set session timeouts so an unattended terminal on a busy counter cannot be hijacked. Exportable audit logs matter more than most merchants realize: when a dispute arrives months later, the ability to show who keyed what, when, from which device and with which verification result is the difference between a winnable case and an expensive shrug. Train staff on a simple script — confirm the name, confirm the billing address, confirm a callback number, note the outcome — and give them explicit permission to slow down or escalate. Employees who fear upsetting a caller will approve bad orders; employees who know the escalation path will not.
Email hygiene belongs in the same conversation. Verify any change of banking details by calling a known contact on a known number, never a number printed in the suspicious email itself. Avoid clicking links in unexpected invoices, and reach supplier portals through your own bookmarks instead. On the phone side, be mindful of call recording: if your calls are recorded for quality, pause the recording before any card details are spoken, or move the payment to a payment link entirely. Store order notes with delivery tracking, signature requirements and courier confirmation attached, because evidence collected at the time of sale is far more persuasive than evidence reconstructed later.
Even with strong controls, disputes will happen. Monitor for dispute alerts while there is still time to respond, assemble the transaction, authorization and delivery detail into a clean evidence pack, track every deadline and read the reason code carefully before replying. For business and wholesale accounts, capture the buyer’s purchase order number on net-term invoices, send a secure payment link with the amount locked, and record part payments against the same invoice so receivables reconcile line by line rather than by guesswork. Fraud prevention, 3-D Secure and disciplined record-keeping all pull in the same direction, though no system can win every dispute. The goal is to make your business a harder target than the next one, and to have the paperwork ready when someone tries anyway.
A Kazakh software architect relocated to Tallinn, Estonia. Timur blogs in concise bursts—think “micro-essays”—on cyber-security, minimalist travel, and Central Asian folklore. He plays classical guitar and rides a foldable bike through Baltic winds.