What Is a Virtual Terminal? A 2026 UK Business Guide

A virtual terminal is the tool you reach for when a customer reads their card number out over the phone and someone on your team has to type it in. It is a browser-based, PCI-compliant form that sits between your keyboard and the card network. No reader, no chip, no tap. Just a screen, the digits the customer just gave you, and a submit button.

It is also the only remote payment method where the cardholder authenticates through nothing at all, and that one fact decides your PCI scope, your fraud liability and which providers will take you.

Virtual Terminal at a Glance

How a Virtual Terminal Works

You log into a secure web portal provided by your payment processor. Your customer reads out their long card number, expiry date, and CVV. You type them into the form, add the amount, and submit. The processor encrypts the data and sends an authorisation request through Visa or Mastercard to the cardholder’s issuing bank. Approval or decline comes back within seconds.

The card data never sits on your device or server. It passes through your keyboard and into the processor’s hosted environment; the processor hosts the terminal, not you. That is the structural requirement that puts you in PCI scope category SAQ C-VT, and it only holds if your terminal computer is properly isolated. More on that in a moment.

One material difference from a chip and PIN transaction shapes everything downstream: no cardholder authentication happens at the point of entry. The cardholder told you their number; you typed it in. No PIN, no biometric, no 3DS2 challenge. The issuer has no way to verify the cardholder consented, and that asymmetry sits with you on every chargeback dispute.

Settlement then runs the same path as any card payment. Your acquirer or PSP holds the funds in a merchant account and transfers the net to your business bank account on the cycle agreed in your contract. Most UK PSPs settle next business day; some traditional acquirers still run two- or three-day cycles.

Virtual Terminal vs Card Terminal vs Online Checkout vs Payment Link

These four methods get treated as interchangeable. They are not. Each handles fraud liability, customer authentication, and PCI scope differently, and the wrong choice does not only cost you transaction fees. It can decide whether you win or lose a chargeback dispute.

Here is the point most articles miss. A payment link and a virtual terminal look similar from the outside: both handle remote payments, both need no hardware. The liability structure is the opposite. With a payment link, your customer authenticates themselves through 3DS2 when they click and pay. With a virtual terminal, you key the transaction and the cardholder authenticates through nothing at all. Every disputed MOTO transaction lands back on you.

The rule is simple. If a customer can click a link and pay themselves, use a payment link. Use a virtual terminal only when they cannot or will not: they are on the phone, they want the payment processed now, or they have sent card details by post as part of a mail-order process.

When a UK Business Needs a Virtual Terminal

The clearest signal is the working-day reality: you regularly receive card details from customers who are not in front of you, and you need to charge the card now, with a record of it.

The UK businesses that use virtual terminals most fall into a handful of recognisable patterns.

Telephone-order businesses. Bespoke food, specialist retail, anything where customers ring up to place an order and want to pay in the same call. Taking bank transfer details means a three-day wait. Asking them to click a payment link often means they hang up before it arrives.

Professional services collecting deposits. Solicitors, accountants, surveyors, architects, consultants. Many of their clients are older or simply prefer a phone call to a portal, and staged payments by phone are a normal billing rhythm.

Healthcare and wellbeing. Private dental practices, physios, private GPs. Confirming a booking and taking payment in the same call is the operating norm.

Charity telephone fundraising. Card donations during a live call. Redirecting a donor to a webpage loses a meaningful share of completions.

Trade and field services. Plumbers, electricians, builders who want to be paid before they leave site or once they are back at the van. The customer reads the card out; the terminal takes 30 seconds.

You probably do not need a virtual terminal if your customers happily click a payment link, if all your sales are face-to-face, or if your monthly phone-payment volume is too low to justify the monthly overhead. The honest threshold for most UK SMEs is this: payment links handle the occasional phone customer fine. A virtual terminal earns its keep when phone payments are a material part of how you trade.

Costs of a UK Virtual Terminal in 2026

Virtual terminal pricing splits into two camps. PSP aggregators charge no monthly fee but a higher per-transaction rate. Traditional acquirers charge a monthly fee and lower per-transaction rates that scale with volume.

The break-even point sits at roughly £3,000–£5,000/month in MOTO volume for most provider combinations. Below that, the no-fee PSPs are typically cheaper in total once you factor in monthly minimums. Above it, the maths usually favours a traditional acquirer, although the gap narrows once PCI compliance fees are billed separately.

Rates sourced from provider websites and merchantsavvy.co.uk, May 2026. takepayments and Trust Payments require a direct quote and cannot be compared from published information.

Two things worth flagging in that table. Stripe’s published rate does not distinguish MOTO from standard CNP transactions, so ask directly whether your specific account carries a keyed-entry surcharge. Most traditional acquirers do charge a 0.2%–0.4% premium on MOTO over card-present rates, and the headline figure does not always show it.

PCI compliance fees are a real cost most rate comparisons quietly ignore. Worldpay’s £5/month and Opayo’s £6/month add £60–£72/year to the headline. Factor those in when you compare against PSPs that include PCI in the base rate.

PCI DSS and SCA Obligations for Virtual Terminal Use

Two sets of rules govern what you have to do with a virtual terminal. They are separate, and they answer different questions.

PCI DSS determines how securely you handle card data. The relevant Self-Assessment Questionnaire for most UK virtual terminal users is SAQ C-VT. You qualify for SAQ C-VT if your only card processing is through a third-party hosted virtual terminal, you use an isolated computing device that is not connected to other systems or network segments in your business, and you do not store card data locally after the transaction.

That isolation requirement is where most businesses quietly fail. Running a virtual terminal on a shared office computer, the one you also use for email, browsing, and the shared drive, does not meet SAQ C-VT. You need a dedicated device, properly firewalled. If you do not have that, your scope escalates to SAQ D: 251 controls instead of roughly 80, and a substantially heavier annual compliance load. Most merchants only discover this when their acquirer asks them to attest.

Under PCI DSS 4.0, mandatory since March 2025, SAQ C-VT merchants picked up three new requirements: automated defences against phishing on the terminal device (Requirement 5.4.1), anti-malware scanning for removable media used near the terminal (Requirement 5.3.3), and a 12-character minimum password for all terminal access (Requirement 8.3.6). If your provider’s compliance questionnaire has not changed in a couple of years, those three are probably the gaps.

SCA, Strong Customer Authentication, simply does not apply to MOTO. The UK Payment Services Regulations 2017 require SCA for electronic payment transactions initiated by the payer. A MOTO transaction is initiated by the merchant. The cardholder reads their card over the phone; they are not submitting a payment through an interface they control. MOTO falls structurally outside SCA scope, not “exempt”, but outside the regulation entirely. No 3DS2 challenge, no authentication step. Your processor handles the MOTO flag on the authorisation message automatically when you use a virtual terminal correctly.

The operational consequence is the part that catches people out. You cannot use the absence of an SCA step to defend a chargeback. There is no SCA step. If the cardholder disputes the transaction, the liability sits with you whether you authenticated them or not.

Fraud and Chargeback Risk

UK card fraud reached £572.6 million in 2024, and card-not-present fraud accounted for around £400 million of that. CNP fraud cases rose 22% year-on-year.

Virtual terminal transactions sit at the riskier end of CNP. CNP chargebacks in the UK run at 0.6%–1.0% on average, and MOTO sits near the top of that range. The reason is structural, not behavioural. The merchant cannot contest an “I did not authorise this payment” chargeback with any authentication evidence, because there is none. The cardholder’s bank reviews the dispute, sees a keyed MOTO transaction with no 3DS2 step, and has nothing to weigh against the cardholder’s claim. The dispute is yours to lose.

Visa and Mastercard typically flag merchant accounts for remediation when chargeback rates exceed 1%. Reaching 1% on MOTO is not difficult if your business runs subscription-style charges, recurring billing, or any category where friendly fraud is common. LexisNexis research suggests each £1 of fraud costs merchants approximately £4.61 once processing fees, lost goods, and admin time are included.

Practical steps that actually reduce MOTO chargeback exposure:

• Use AVS and CVV checks. Address Verification Service checks the billing postcode and house number against the cardholder’s bank record. CVV confirms the card is physically in hand. Neither is foolproof, but together they screen out a meaningful share of fraudulent phone attempts. If either fails, ask the customer to try again or decline.
• Telephone scripting. Train staff to read a standard consent statement before charging: the amount, the merchant name, and the cardholder’s explicit go-ahead. Record calls where your legal and compliance position allows it.
• Delivery address verification. For physical goods, check delivery against billing. Mismatches are a reliable MOTO fraud signal.
• Order caps for new customers. Cap maximum transaction values for first-time phone orders until you have a track record with that customer.
• Keep a clear audit trail. Note the call time, the name the caller gave, the delivery address, and which operator took the payment. None of this wins a chargeback by itself. It is what gives you a representment case worth filing.

UK Virtual Terminal Providers in 2026

The honest split in the UK market is between PSP aggregators (Stripe, Square, SumUp) and traditional acquirers who give you a dedicated merchant account. The right choice depends on your volume and your appetite for monthly overheads.

Stripe is the default choice for UK SMEs who want a virtual terminal without a contract or monthly fee. The Dashboard virtual terminal is included in every Stripe account at no extra cost, and the 1.5% + 20p rate undercuts Square and SumUp on standard UK debit and credit. The catch is structural: Stripe is a PSP aggregator, so you hold a sub-account rather than a direct acquiring relationship. Automated risk flags can freeze funds while a review runs, and that risk is materially higher with irregular or high-value MOTO. If your phone takings are spiky, have a backup account ready before you need it.

Square charges 2.5% per keyed transaction with no monthly fee. The thing to notice is that Square’s MOTO rate (2.5%) is higher than its own in-person rate (1.75%) and higher than Stripe’s standard UK rate. If you run phone and face-to-face payments through Square, you are paying two different rates and they should both be in your sums.

SumUp charges 2.95% + 25p, the highest of the no-contract three. Volume above £60,000/year qualifies for a negotiation. Below that, the rate is what it is. SumUp earns its place here for businesses already using its readers who want one provider for everything; for MOTO-first operators, the headline rate is hard to defend.

Worldpay is the largest UK acquirer by merchant count and bundles a virtual terminal into most merchant account packages. Rates run 1.00%–1.90% on volume tiers, with a £15/month minimum service charge and £5/month PCI fee on an 18-month contract. For businesses doing consistent MOTO above roughly £5,000–£8,000/month, the volume tier beats no-contract PSPs once you do the maths in full. Below that, the monthly overheads work against you.

Opayo (Elavon) offers two routes: pay-as-you-go (£0/month, 1.99% per transaction, £99 joining fee) and a monthly plan (£25/month, rates from 0.50%). The crossover lands at around £2,500/month in MOTO volume. PAYG is the sensible entry point if you are not yet sure how much you will process; the monthly plan only pays back once volume is consistent.

Tyl by NatWest charges £14.95/month base and 1.50% for businesses under £50,000/year. Tyl is one of the few providers that explicitly states no surcharges on international card payments, refunds, or cancellations, which is the one reason it earns a place here if you take a meaningful share of non-UK cards. For UK-only volume, Worldpay’s tiered rate beats it.

takepayments and Trust Payments both run virtual terminal products on bespoke pricing. You cannot meaningfully compare either without going through their quote process. They are worth approaching if your volume is substantial or your industry is specific; Trust Payments in particular has an established footprint in regulated sectors like hospitality and retail. For a small MOTO business comparing rates on a spreadsheet, neither is the right call.

Adyen and Checkout.com are enterprise-grade. Adyen’s IC++ pricing only becomes cost-effective well above £500,000/year in card volume; below that, the minimum charges and onboarding complexity make both impractical. If your MOTO volume is sub-enterprise, they are not the answer.

Before signing any virtual terminal agreement, pin down two things in writing: whether the published rate includes a MOTO uplift or whether keyed entries carry an extra surcharge, and whether PCI compliance is bundled into the monthly fee or billed separately. Both move the real cost meaningfully.

How to Set Up a Virtual Terminal as a UK Business

The process varies by provider type. PSP aggregators approve applications within hours; traditional acquirers typically take 2–5 business days for standard businesses. Either way, you need the same core documents.

What underwriters want to see:

• Companies House registration number (limited companies) or proof of business activity (sole traders)
• UBO (ultimate beneficial owner) declaration for all shareholders holding 25% or more
• Photo ID (passport or driving licence) for each director and UBO
• Proof of address for each director, issued within three months
• Three months of business bank statements showing trading activity
• Projected monthly MOTO volume and average transaction value
• Your merchant category code (MCC), or your provider will classify you
• A basic web presence, even if you are a phone-only business, since many acquirers require a URL to verify legitimacy

The underwriting question most small businesses fluff is projected MOTO volume. Underwriters want a realistic figure. Quoting a lower number to ease approval creates problems later: when your real volume runs higher, your account terms need renegotiating, and that conversation is rarely in your favour.

Some industries face longer underwriting or get declined outright. Nutraceuticals, subscription boxes with free-trial models, certain financial advisory services, and businesses with prior regulatory issues typically face enhanced due diligence and may be offered restricted terms or higher rates. A handful of high-risk categories cannot access a virtual terminal through mainstream acquirers at all and need specialist MOTO-focused processors.

Once approved, the setup is the easy part. Your provider gives you login credentials, you access the terminal through a browser on a dedicated device, and you are ready to process. Most providers run a short test phase where you can put through a small live transaction before going live properly.

One operational point worth settling before you go live: what happens if your virtual terminal account is suspended. PSP aggregators can freeze accounts with minimal notice, usually triggered by automated risk flags around unusual transaction patterns or an elevated chargeback count. Having a backup PSP for business continuity, even one you barely use, is what separates an inconvenient afternoon from a week of unrecoverable lost trade.

Frequently Asked Questions

Can I use a virtual terminal without a separate merchant account?

Yes. PSP aggregators like Stripe and Square include a virtual terminal in their standard account, so you do not need to open a dedicated merchant account separately. What you have instead is a sub-account inside their pooled merchant structure. That works well at lower volumes. For higher volumes, or where you want a direct acquiring relationship and greater contractual stability, a traditional merchant account is worth the extra setup time.

Do I need a physical card terminal as well?

Only if your business also takes face-to-face card payments. A virtual terminal handles card-not-present payments only. Chip and PIN on a physical reader carries different liability and different compliance rules from a MOTO transaction. Many providers offer both under the same account. If you only take phone payments, the virtual terminal is sufficient on its own.

Can a virtual terminal process recurring payments and subscriptions?

Most virtual terminals support tokenisation: a saved card token that lets you charge a customer again without them reading their card number to you twice. That is how phone-based subscriptions and recurring invoiced billing actually work in practice. Not all basic virtual terminal products include tokenisation, and some providers charge for it separately. If recurring billing is part of your model, confirm tokenisation specifically before you sign.

Is it legal to take card details over the phone in 2026?

Yes, with conditions. MOTO is a recognised payment method under UK card scheme rules and the Payment Services Regulations 2017. You must process through a secure, PCI-compliant virtual terminal, you must not store the CVV after the transaction (PCI DSS Requirement 3, this is mandatory), and you must handle the associated personal data under GDPR. Writing the full card number and CVV on paper, or saving them in an email or spreadsheet, breaches PCI DSS regardless of how the transaction itself is processed.

What happens if a customer disputes a MOTO payment?

The chargeback is initiated by the cardholder through their issuing bank. As the MOTO merchant, you have a fixed window, typically 20–45 days depending on the card scheme, to file a representment. Your strongest evidence is a clear record of the transaction: call logs, caller ID, the verbal consent statement your staff used, delivery confirmation, and any prior transaction history from the same customer. MOTO chargebacks are harder to win than chargebacks on 3DS2-authenticated online transactions because there is no authentication step to point to. If you lose, the transaction value plus a dispute fee (typically £15–£25 per case) is debited from your account.

What is the difference between a virtual terminal and a payment link?

A payment link is a URL you send to a customer by email, text, or messaging app that takes them to a hosted checkout page where they enter their own card details. The customer controls the entry, 3DS2 authentication typically applies, and if the payment is authenticated, fraud liability shifts to the card issuer on a disputed charge. A virtual terminal is where you enter the card details on the customer’s behalf, usually because they are on the phone with you. The customer never touches the payment interface, there is no 3DS2, and fraud liability stays with you. If a customer can pay through a link without significant friction, the link carries less risk. A virtual terminal is for the situations where that is not possible.