Yes. You can take a customer's card details over the phone, set up a direct debit from a verbal instruction, or send a payment link while you're still on the call and let them pay it themselves. Taking a spoken card number brings your staff, phones and systems into the card industry's security rules (PCI DSS), so a payment link during the call is usually the simplest option.
In this article
The short version
- You can take a card by phone, a verbal direct debit or a payment link during the call.
- A spoken card number brings your staff and phone systems into PCI DSS scope.
- The card security code must never be kept, including in call recordings.
- Phone card payments usually carry the fraud risk without an app check.
- A payment link during the call keeps card details away from your team.
Three ways to take a payment by phone
A customer rings to settle an invoice. You have three options, and they carry very different amounts of work behind them.
- They read out their card number and you key it into your provider's virtual terminal.
- They give you a direct debit instruction verbally, so you can collect this invoice and future ones.
- You send them a payment link by email, text or WhatsApp while you're talking, and they pay it on their own phone.
All three are lawful. What differs is how much of the security burden lands on you.
What a spoken card number means for security
If you take card details, you're covered by PCI DSS, the security standard the card schemes require every business that handles card data to follow. The PCI Security Standards Council's guidance on telephone payments says that once your staff hear a card number, the people taking the call, the phones they use and the systems those phones connect to all come into scope.
A couple of everyday habits make that worse. Writing a card number on a notepad, or letting a customer leave it on an answering machine, counts as storing card data, which brings more of your business into scope. If card details ever do end up on paper, keep them locked away and shred them as soon as the payment's done.
Call recording needs particular care. The card security code must never be kept after the payment is authorised, even encrypted, and the Council applies that to audio recordings too. So either the code mustn't be recorded at all, or the recording has to be deleted securely straight after authorisation. Two common fixes work differently:
- DTMF masking, where the customer keys their card number into their own handset and the tones are hidden from your agent and your recordings, can take your phone system and your staff out of scope.
- Pause and resume, where recording stops while the number is read out, solves the recording problem but leaves your staff and systems in scope.
Telephone card payments are generally treated as outside strong customer authentication, the extra check that sends a customer to their banking app when they pay online. So there's no app check to protect you, and if the payment turns out to be fraudulent, the loss usually falls on you. Ask your provider how it treats phone payments and where the liability sits before you start.
If you do take cards over the phone through Adfin, its pricing adds 0.5% to the card rate for phone payments.
How to set up a direct debit by phone
A verbal direct debit instruction is allowed, through what Bacs calls paperless direct debit, and it can be a better option than a card for a customer you'll bill again. You set it up once, and from then on you're not handling payment details on every call.
There are conditions. Paperless direct debit is only open to organisations that meet extra criteria, and it's your responsibility to check who the customer is and that their account details are right. You also have to send the customer written confirmation of the instruction within three working days. In practice your direct debit provider handles most of this, so check with them that phone sign-ups are supported before you offer it.
The customer still gets advance notice of each collection and the protection of the Direct Debit Guarantee, just as they would with a mandate signed online.
How to send a payment link during the call
The option with the least risk is to stay on the line and send a payment link. Your customer opens it on their phone and pays by card, Apple Pay, Google Pay or pay by bank. They confirm the payment in their own banking app or wallet, you see it arrive, and nobody reads out, types or writes down a card number. The card data is handled by your provider's payment page, not by your staff or phone system, although how your own PCI obligations are assessed still depends on your setup.
Adfin's payment links carry card, Apple Pay, Google Pay, pay by bank and bank transfer, and you can send them by email, SMS or WhatsApp, so a call that starts with "how do I pay this?" can end with the invoice paid. The payment is matched back to the invoice in Xero or QuickBooks. And if the customer says they'll pay later, Adfin's collection agents can follow up with the same link on a schedule you set, without anyone on your team having to remember to call back.
Common questions
Is it legal to take card payments over the phone in the UK? Yes. Telephone card payments are a normal way to take money. You need to follow PCI DSS and your provider's own conditions.
Can I write down a customer's card details during a call? You can, but it counts as storing card data, which widens your PCI DSS obligations. Any paper must be kept secure and shredded once it's no longer needed.
Can we record calls where customers give card details? Only if the security code isn't kept. It mustn't be stored after authorisation, even in a recording, so suppress it or delete the recording securely straight away.
Does strong customer authentication apply to phone payments? Telephone card payments are generally treated as outside it, which means the fraud risk usually sits with you. Check with your provider how it handles them.
Can a customer set up a direct debit over the phone? Yes, if your provider supports paperless direct debit. You must verify the customer's details and send written confirmation within three working days.
What's the simplest way to take payment during a call? Send a payment link while you're on the line, so your customer pays on their own phone and no card number is read out.
Sources
- PCI Security Standards Council - Protecting telephone-based payment card data (accurate as of October 2026) https://listings.pcisecuritystandards.org/documents/Protecting_Telephone_Based_Payment_Card_Data_v3-0_nov_2018.pdf
- PCI Security Standards Council - FAQ 1210 on storing security codes in audio recordings (accurate as of October 2026) https://www.pcisecuritystandards.org/faqs/1210/
- Bacs - Paperless Direct Debit (accurate as of October 2026) https://www.bacs.co.uk/bacs-schemes/direct-debit/services/paperless-direct-debit/
- FCA - Strong customer authentication (accurate as of October 2026) https://www.fca.org.uk/firms/strong-customer-authentication
- Adfin - Pricing (accurate as of October 2026) https://www.adfin.com/pricing
