Track 04
Promise: you will know why online and keyed payments cost more than counter sales, and which settings in your setup lower that cost instead of just paying it.
Every card transaction falls into one of two families. Card-present: the card (or phone wallet) is physically at your terminal and read by chip or tap. Card-not-present (CNP): the number arrives without the card — typed into your website, keyed into your terminal from a phone order, or stored on file and charged later.
The families are priced differently for one reason: fraud risk. A chip read is extremely hard to counterfeit, so issuers accept more of the risk. A bare card number can be stolen and tested anywhere on earth, so issuers price that risk into interchange and push more of the loss back to you when fraud happens. This is not your processor upselling you. It is the published structure of the system (Track 02), and you can see it in a single comparison:
Same card, two doors
| Basic Visa credit, chip read in store (CPS Retail) | 1.51% + $0.10 |
| Same basic Visa credit, keyed in (Keyed CPS Retail) | 1.90% + $0.10 |
On a $200 sale, the keyed version costs about 78 cents more in interchange alone — before processing fee. Multiply by a month of phone orders and the gap is a real line item. Every CNP decision you make is about narrowing that gap or earning something worth more than it.
AVS (Address Verification Service). At checkout, the customer enters their billing ZIP (or full address), and the issuer reports back how much of it matches the address on file. A ZIP match is a meaningful fraud signal; a full mismatch on a first order from a new customer deserves a pause. AVS results also become evidence if the sale is later disputed (Track 03).
CVV. The three-digit code on the back of the card (four on Amex fronts) proves the buyer likely holds the physical card, because the code is never stored in card databases the way numbers are. Require it on every online and keyed transaction. Selling without it discards your easiest fraud screen and can worsen your pricing category.
Tokenization. When a gateway "saves a card," it should not store the number. It stores a token — a stand-in value issued by the payment network or gateway that works only for your business. Tokens make card-on-file billing (Track 08) safe enough to offer: a breach of tokens is not a breach of card numbers.
3-D Secure (where it fits). The "Verified by Visa / Mastercard Identity Check" step that asks the cardholder to confirm in their banking app. When a transaction passes through it, fraud liability for that sale generally shifts to the issuer. It adds a checkout step, so many merchants reserve it for larger tickets or riskier orders — but for the right basket size it converts your riskiest sales into the issuer's problem.
Full online checkout (a real store or booking page) is the strongest CNP channel: AVS and CVV run by default, tokenization is built in, and the evidence trail is automatic.
Payment links and invoices — a link you text or email that opens a hosted payment page — give you the same protections without a full website. This is the right default for deposits, phone orders, and one-off bills.
Keying into the terminal is the weakest channel: no checkout page working for you, easy to skip CVV in a hurry, and the highest interchange category of the three. Sometimes a phone customer leaves no choice — but make keying the exception, and always capture CVV and billing ZIP when you do it so the transaction carries its evidence with it.
Card on file is not a channel but an agreement: the customer authorizes you to store a token and charge it under stated terms. Get that authorization in writing, state when charges will occur, and keep the record. An authorized on-file charge with a paper trail wins disputes; a number scribbled on an order pad wins nothing and creates real liability.
Walk-through — a $340 phone order for pickup Friday
The habitual way: the employee keys the card number into the register, no CVV ("the customer sounded nice"), no ZIP, no authorization note. The sale prices in the keyed interchange category. If it is disputed, the store has a receipt and nothing else.
The set-up way: the employee texts the customer a payment link for $340. The customer pays on the hosted page — CVV entered, billing ZIP checked by AVS, card tokenized for the Friday balance. The store's cost is the online category rather than the keyed one, and if a dispute ever comes, the AVS result and the tokenized payment record are already in the file.
Same customer, same $340, same Friday pickup. The difference is entirely in which door the payment walked through.
Do not run card numbers through your own website's forms unless the page is served by your gateway — the moment raw numbers touch your systems, your PCI compliance burden (Track 08) grows teeth. Do not store card numbers in spreadsheets, emails, or notebooks. Do not treat a successful authorization as proof a sale is safe: authorization means the account had funds and was not reported stolen at that moment; the evidence controls above are what protect the sale afterward.
Audit your card-not-present setup against these items.
Two Minutes
The free EBS Growth Check reviews six areas — payments, equipment, funding readiness, benefits, formation, and marketing — and shows where your current setup costs you more than it should.