Card-Not-Present Fraud on Phone Bookings

Why this matters

When a caller reads you a card number over the phone, you have accepted the riskiest kind of card payment there is, and the risk is yours. If the card turns out to be stolen, the real cardholder disputes the charge weeks later, the money comes back out of your account, and the parts you installed and the hours you spent are gone with it. A shop that never sees this for years can lose the profit of several good jobs to one convincing Friday-afternoon call. The defense is not suspicion of every caller. It is knowing the handful of patterns that show up again and again, and the two or three checks that cost a minute.

Card-present versus card-not-present

Card-present means the physical card touched your reader: dipped, tapped or swiped. Card-not-present (CNP) means you got the number some other way: read over the phone, typed into a virtual terminal (a web page from your processor where staff key in card details), entered by the customer into an online booking form, or sent on a payment link.

The distinction matters because of who carries the loss when the card is stolen. Under card network rules, a chip card dipped in a chip reader generally moves counterfeit-fraud liability away from the merchant. A keyed or phoned-in transaction has no such protection: if the cardholder says "that was not me", the default is that the merchant eats it. Address and security-code checks lower the odds of fraud but do not move that liability. The one common tool that can is cardholder authentication on an online payment (often called 3-D Secure, where the card issuer challenges the customer with a code or app prompt); a payment link from your processor may offer it, a number read aloud never can.

The patterns that repeat

These show up across trades. One alone means little. Two or three together, on a new customer, is the time to slow down.

• Rush plus distance. "I need this done today, I am out of the country, the tenant is there." Urgency stops you checking; distance means you never meet the payer.
• The payer is not the person at the property. A property manager you cannot look up, a relative "paying for Mom", an investor buying for a house they just closed on.
• Indifference to price. A caller who agrees to a full replacement without asking what it costs, or who wants to pay the whole ticket up front. Real customers ask.
• Address mismatch. The billing address or ZIP for the card does not match what the caller gives, or the service address is a vacant listing.
• Declines, then a different card. The first card fails, the second fails, the third goes through.
• Money that has to move onward. A request to charge extra and pass some on to "my mover", "my supplier" or "the other contractor". This is a refund in disguise and belongs with the overpayment scam. See related: The Overpayment Refund Scam.
• Refund to a different card. Asked a few days after the charge, before the job. Never.
• Strings of small deposits on an online booking form. Many tiny charges, many declines, odd names, within minutes. That is card testing: a criminal checking which stolen numbers still work, using your form because it is unguarded. You lose the processing fees on every attempt and risk your processor flagging the account.

What the real call sounds like

The exchange below is typical of the rush-plus-distance pattern, and the check that matters is in the office's last two lines.

CALLER: Water heater at 41 Elm is leaking all over.
        I'm the owner, I'm overseas till next month.
        Tenant's home. Just replace it, charge my card.
OFFICE: Sure. Can I get a number for you?
CALLER: Use this one, I'm hard to reach.
OFFICE: And the card's billing ZIP?
CALLER: Uh, it's a business card, different ZIP.
OFFICE: No problem. We'll send a secure payment
        link to the email on the account, and the
        tech will check the leak with the tenant
        first. Once the link's paid we'll set the
        install.
CALLER: Can't you just take it now? It's urgent.
OFFICE: The tech can stop the leak today either way.
        The install waits for the link.

The office did not refuse the job and did not accuse anyone. It moved the payment onto a channel that can authenticate the cardholder, and it separated the emergency (stop the water, a short visit) from the expensive commitment (a new heater). A legitimate owner pays the link in two minutes. A fraudster usually goes quiet.

Five checks worth building in

1. A payment link instead of a number read aloud. The customer enters their own card on your processor's hosted page, which keeps the card number out of your hands and, where the processor supports cardholder authentication, can shift fraud liability off you. It is the single biggest change a shop can make to phone bookings.

2. Address and security-code results, read and acted on. Your processor returns an address verification (AVS) result and a security-code (CVV) result on every keyed transaction. Most shops never look. A ZIP mismatch on a first-time customer is a reason to stop, not a detail. Remember that a full match does not protect you in a dispute; it only means the person has the card's details, which a thief buying stolen data often does.

3. A call back on a number you found yourself. Not the number the caller gave. The property's listed owner from the county assessor's public records, the management company's published office line. See related: The Verify-on-a-Second-Channel Rule.

4. Holding special-order material until payment is verified. The loss on a fraudulent emergency repair is a few hours of labor. The loss on a fraudulent replacement is the equipment as well, which is most of the ticket.

5. A deposit cap for unverified new customers. A shop default worth starting from: an unverified first-time CNP customer pays no more than the cost of the first visit until verification is done. Tune it to your trades.

For online booking forms, turn on whatever the processor offers to stop card testing: a challenge before payment, a limit on attempts per visitor, and an alert on a burst of declines.

The chargeback exposure, in full

A chargeback is the card issuer reversing a charge on the cardholder's behalf. For fraud claims, card network rules commonly give the cardholder up to about 120 days from the transaction date to dispute, so a job can look settled for months before it unwinds. The networks change their rules periodically; your processor's merchant agreement states the current windows.

When one lands, four things happen. The disputed amount is pulled from your account. Your processor charges a chargeback fee per dispute, set in your merchant agreement. You get a short window to respond with evidence, often one to three weeks and set by the processor, and missing it forfeits the dispute. And the dispute counts against your chargeback ratio, disputes as a share of transactions; card network monitoring programs start watching merchants as that ratio approaches about one percent, with thresholds the networks revised in 2025, so check your processor's current figure. A shop with a few hundred card transactions a year does not need many disputes to get there.

Can you win a fraud chargeback on a keyed card? Sometimes, with a signed work order from the person at the property, photos of the completed work, and records linking the cardholder to the address. Often not, because the real cardholder genuinely did not authorize it, and the issuer knows that. Plan as though you will lose.

A worked example

A shop takes a call at 4:15 on a Friday. The caller says she manages a rental, the tenant reports no hot water, and she wants the 50-gallon heater replaced today on her card. The card's billing ZIP does not match. The office keys the card anyway because the tech is close by. The heater and the install go in, and the full ticket is charged. Thirty-eight days later a fraud chargeback arrives. The real cardholder lives two states away and has never heard of the property.

Lay the loss out as shares of that one ticket:

• The full ticket comes back out of the account: 100 percent of the revenue.
• The heater, fittings and venting the shop paid for are installed and cannot be recovered: about 40 percent of the ticket.
• Labor, truck and overhead for the visit, already spent: about 45 percent of the ticket.
• The processor's chargeback fee, on top.

So the shop spent about 85 percent of the ticket (40 plus 45) doing the work and collected nothing. At this shop's net margin of about 15 percent of a typical ticket, earning back 85 percent of a ticket takes 85 divided by 15, roughly 5.7 normal jobs of profit, call it six, before counting the fee.

Now run the same call through the checks. The ZIP mismatch on a new customer stops the keyed charge. The office sends a payment link and calls the management company's listed office line, which has never heard of the caller. The tech, if the shop chooses to go at all, shuts off the leaking heater with the tenant present and leaves. The exposure drops from 85 percent of a replacement ticket to the cost of one short trip, which the shop can decide to absorb as goodwill toward the actual tenant.

What would change the answer. If the caller had been a repeat customer with a card on file from a prior chip transaction, the risk is far lower and the friction is not worth it. If your processor offered cardholder authentication on payment links and the link was authenticated, a later fraud claim would generally fall on the issuer rather than on you, under network rules that your processor's agreement spells out; confirm whether your specific link product carries that shift, because not all do.

Telling the office the rule

Give office staff a sentence they can say without feeling rude, and the authority to say it: "For new customers we send a secure payment link rather than taking card numbers over the phone. It protects your card as well as us." Most legitimate callers prefer it. The ones who argue hardest against it are telling you something.

References

• Card network dispute rules as summarized in your processor's merchant agreement and chargeback documentation
• PCI Security Standards Council guidance on card-not-present and phone payments
• See related: The Verify-on-a-Second-Channel Rule
• See related: The Overpayment Refund Scam
• See related: Taking Card Payments in the Field Without Exposing Card Data