Paying by card over the phone safe?

[Z064life]

Hi All,
So I need to pay the council something, and the payment is done over the phone. I have no issue with this, but how do I know this is secure?

My concern is surely the recipient of my card details could go of and use them to purchase stuff?

Should I look at alternatives?

[condor]

I've done it a few times and not had a problem, mainly for sport activity programmes - you're usually given a reference number to mention if there's a problem. Might be a good idea to write down time and date of the call too. You could also ask the name of the person you're talking to as well

[Bungleaio]

This is how it used to work in the 90s when I was buying things mail order. Also more recently for reservations on camping pitches, I don't know if I've just been lucky or not but I've never had an issue.

[Z064life]

In theory there's nothing someone using the details online to pay for goods right?

[technodup]

I don't like direct debit so I pay for most things by card, gas, council tax etc.

Can't believe anyone hasn't done it tbh.

Yes there's 'in theory' but that's the case whatever method you use.

[Trabi601]

technodup said:

I don't like direct debit so I pay for most things by card, gas, council tax etc.

You do realise that Direct Debit is significantly less risky than paying by card, don't you?

[technodup]

It depends on what you consider risk.

[romeogolf]

If the person on the other end of the phone took your details and used them, they would only be able to make another online or over-the-phone transaction which is recorded as "cardholder not present". The card slip/receipt would state "no cardholder verification".

In these situations, if an unrecognised transaction appeared on your statement, you are protected as there was no verification of your details. Essentially the risk falls to the merchant and the card provider. Usually, the card provider places the funds back in your account (they may do this under the 'pending transactions' label) and investigates before refunding. I'm sure there are rules about the time limits for this.

From a merchant perspective, the funds get taken away from us immediately in a charge-back, and it's only if we can supply evidence to support the transaction being genuine that if would be allowed to continue.

My advice is to always use a credit card rather than debit card where possible, so 'held' funds are unlikely to cause charges/issues while the investigation completes.

[Ean218]

Trabi601 said:

You do realise that Direct Debit is significantly less risky than paying by card, don't you?

Different risk entirely and not one that I am willing to expose myself to either.

Much happier with a credit card, it is the banks money and their risk, not mine.

[Trabi601]

Ean218 said:

Trabi601 said:

You do realise that Direct Debit is significantly less risky than paying by card, don't you?

Different risk entirely and not one that I am willing to expose myself to either.

Much happier with a credit card, it is the banks money and their risk, not mine.

One of the challenges with credit cards is that once you've signed a credit card mandate, it can be very difficult to cancel future payments - you have to rely on the vendor cancelling, so it's out of your control.

At least with DD, you can cancel yourself.

Of course, DD isn't applicable to one-off payments, for which a credit card is the answer.

However, for regular payments, I'll always go DD over credit card.

[Ean218]

Why on earth would you sign a credit card mandate to take regular payments? That's dottier then doing a DD.

Have you not heard of standing orders? You are then completely in charge of where your money goes, and when.

[Ziplobb]

The majority of direct debits come with the DD guarantee - that is to say your bank HAVE to refund you if you dispute it - continuous authority payments via debit card and credit card do not and have to be cancelled via the originator or the company you are spending your money with which in some instances can be very hard and time consuming.

[Z064life]

romeogolf said:

If the person on the other end of the phone took your details and used them, they would only be able to make another online or over-the-phone transaction which is recorded as "cardholder not present". The card slip/receipt would state "no cardholder verification".

In these situations, if an unrecognised transaction appeared on your statement, you are protected as there was no verification of your details. Essentially the risk falls to the merchant and the card provider. Usually, the card provider places the funds back in your account (they may do this under the 'pending transactions' label) and investigates before refunding. I'm sure there are rules about the time limits for this.

From a merchant perspective, the funds get taken away from us immediately in a charge-back, and it's only if we can supply evidence to support the transaction being genuine that if would be allowed to continue.

My advice is to always use a credit card rather than debit card where possible, so 'held' funds are unlikely to cause charges/issues while the investigation completes.

Thanks but when you make a purchase online, there's no check if you are the card holder? You can even make billing and shipping address different,

[feef]

Z064life said:

In theory there's nothing someone using the details online to pay for goods right?

yes and no.

if you have 3DSecure/Verified By Visa set up on your card, then they can't use it online without inputting the password you have set.

In that case, you can't easily dispute the transaction as your password must be used.

If the merchant doesn't support 3DSecure/Verified by Visa, then the responsibility then lies with the merchant to demonstrate that they took adequate steps to verify the authenticity of the card holder.

[romeogolf]

Z064life said:

Thanks but when you make a purchase online, there's no check if you are the card holder? You can even make billing and shipping address different,

Correct, and it offers the same protection as it is classified as a "cardholder not present" transaction. If you're concerned, you can set up a block on most accounts under which the card provider doesn't allow any such transaction, meaning the card can only be used in person with a PIN.

[toastyhamster]

Worth pointing out that in a lot of cases the person on the end of the phone will not always actually see your card details, in fact if they are above a certain transaction level they most probably don't. Google "PCI SAQ levels" and "DTMF Suppression". If they're taking your card number themselves then you have every right to ask about the controls in place to protect that data.

Similar to most web sites where it's hugely simpler from a compliance perspective for the vendor to hand off the credit card transaction to a third party. Storing CCNs is a headache for everybody, but for a lot of businesses it's cheaper to pay the fine than it is to fix the issue.