Authorize.Net Virtual Terminal: Phone, Mail and Invoice Payments

An online virtual terminal is a card machine on a web page. Instead of swiping a card, you type the details in. Authorize.Net describes it simply: "Submit manual orders quickly and securely with our Virtual Terminal using your web browser."

It lives in the Merchant Interface, the website where you manage your Authorize.Net payment gateway account. From there you can:

• Charge a card. The payment is authorized and captured in one step, then settles with that day's batch.
• Authorize only. The funds are held on the customer's card, but you don't collect them until you capture the payment later. This suits orders you ship after taking payment.
• Take an eCheck. Debit a customer's U.S. bank account, if eCheck is turned on for your account. It's a separate service with its own fees. See Authorize.Net eCheck processing.

How you log in. You sign in to the Merchant Interface with your own username and password. You'll also see an API Login ID and Transaction Key in your account settings. Those are for connecting a website, shopping cart or software to the gateway. You don't need them to use the virtual terminal, and you shouldn't share them with staff who only key in payments.

VPOS meaning: a virtual POS, or virtual point of sale, is software that turns a computer, tablet or phone into a checkout for in-person sales. Instead of a dedicated countertop terminal, you use a device you already have plus a small card reader that takes chip, tap or swipe payments. Some providers use "virtual POS" loosely for a virtual terminal too, so check which one you're being offered.

The benefits of a virtual point of sale

• Uses hardware you already have. A PC or tablet and a small reader instead of a dedicated terminal.
• Lower card costs than keying. A dipped or tapped card is a card-present sale, which usually costs less than typing the same card into a virtual terminal.
• Less fraud risk. Chip and contactless payments are much harder to fake than a typed card number, and card-present sales usually see fewer chargebacks.
• Receipts and records in one place. Print or email receipts, and see in-person sales next to your online and phone payments in the same account.

Authorize.Net's VPOS today

Authorize.Net's legacy Virtual Point of Sale reached end of life on February 24, 2026. Its support article names the replacement as the "Authorize.net 2.0 Virtual Point of Sale (VPOS) App for Windows," which runs on a Windows 11 PC or Surface device. The BBPOS Chipper 3X reader is supported; the older Augusta and Chipper 2X readers "are no longer supported and will not work with the new Windows App." Authorize.Net lists chip card support on the First Data Nashville and TSYS processing platforms only, so ask which processor your merchant account runs on before you buy a reader. For phones, card readers and Tap to Pay, see mobile payment processing with Authorize.Net.

Phone and mail orders are known in the industry as MOTO (mail order/telephone order). Every payment you key into a virtual terminal is a card-not-present sale: the card isn't in front of you, so you can't check the chip or the cardholder. If a stolen card is used, the chargeback usually lands on you. A few habits cut that risk.

Always collect the address and the card code

• Address verification (AVS) compares the billing address and ZIP code the customer gives you with what the card issuer has on file.
• Card code verification (CVV) checks the 3- or 4-digit code on the card. A thief with only a card number usually doesn't have it.

Ask for both on every call, and type them in exactly. How a mismatch is handled (decline, hold for review or let it through) depends on your account's settings and fraud filters. Our guide to the Authorize.Net Fraud Detection Suite walks through the AVS, CVV and other filter settings.

Never write down or email card numbers

Type the card straight into the virtual terminal while the customer is on the line. Don't write it on a notepad, a sticky note or an order form, and don't ask customers to email or text card details. Once card numbers sit on paper, in an inbox or in a spreadsheet, you have to protect them under the card industry's security rules (PCI DSS). If a customer mails you a paper order form with a card number on it, key it in, then shred the card details.

Other habits worth building in:

• Be wary of first-time orders that are unusually large, rushed, or shipping to an address that doesn't match the billing address.
• Keep notes on each phone order (who called, what they bought, where it shipped) in case you need to answer a dispute. Just leave the card number out.

For the basics of the security standard, read PCI compliance for small businesses. For the fraud patterns to watch for on phone and online orders, see card-not-present fraud.

If you have a stack of payments to run, you don't have to key them one at a time. In Authorize.Net's words, "Batch Upload allows you to upload multiple credit card or echeck transactions in a single file eliminating the need to manually enter multiple transactions."

Two cautions:

• An upload file holds card or bank details, so treat it like cash. Build it, upload it, then delete it. Don't keep it on a laptop or email it around.
• If you charge the same customers on a regular schedule, saved payment profiles and scheduled billing are safer than re-uploading card numbers every month. See below.

Often the safest phone order is one where you never hear the card number. Instead of keying the card, you send the customer a link and they pay on Authorize.Net's secure payment form.

Digital Invoicing

Here's what Authorize.Net's invoicing feature page and its support article (last modified May 15, 2026) say, checked September 27, 2026:

• Included: "Digital Invoicing comes with every plan." The support article says "There are no fees specific to Invoicing. Normal transaction and batch fees apply, as well as any fees associated with CIM."
• How customers pay: by "credit card, debit card, eCheck (ACH), Apple Pay, Google Pay, or PayPal from the same link."
• Line items: up to 30 per invoice.
• Partial payments: you can let customers pay in parts and set a minimum payment.
• Repeat invoices: invoicing "works with Authorize.net Recurring Billing to send invoices on a schedule you define."
• Setup: Customer Information Manager (CIM), Authorize.Net's saved-customer feature, must be turned on. Its monthly fee is $0 on the pricing page.

Which payment options your customers see depends on your account. eCheck needs its own enrollment. Authorize.Net supports Apple Pay and Google Pay only with certain processors (the company that handles your merchant account behind the gateway), and its lists are different for each wallet. Its support pages also say PayPal Express Checkout isn't supported by some resellers. Before you promise a customer they can pay with a wallet, ask your provider what your account supports.

Payment links, buttons and QR codes

For a fixed-price product, service or donation, Authorize.Net's Simple Checkout lets you "create a Buy Now or Donate button, share a payment link, or generate a QR code. No website required." Setup and options are covered in our Authorize.Net integration guide.

Which one you use depends on whether the payment has settled yet. Settlement happens once a day, when the gateway sends that day's batch of payments to be funded.

A few timing details from Authorize.Net's support articles, checked September 27, 2026:

• Batch cut-off: the default is 4:00 PM Pacific Time. It can be changed. Authorize.Net suggests setting your account's time zone first. If you void a sale, do it before the cut-off.
• Refund window: "Linked credits can be issued up to 180 days after the settlement of the original transaction."
• Finding old sales: Authorize.Net keeps the current year plus the last two years of transaction data. A search by full card number only goes back 180 days. Search by the last four digits to go back two years.

The virtual terminal has an optional field called "Recurring Transaction." It doesn't set up automatic charges.

Authorize.Net's support article says the field "is not part of the Automated Recurring Billing system." It only marks a payment as a repeat charge, which may qualify for lower rates if your merchant agreement allows it. It also has a side effect: "Enabling the 'Recurring Transaction' field will disable 'Card Code Verification' and 'Address Verification'." The idea is that those checks were done on the customer's first payment.

So use it only for repeat charges to a customer you've already verified. Don't tick it on a first order from a new caller, or you lose two of your main fraud checks.

To actually charge customers on a schedule, use Authorize.Net's Automated Recurring Billing with saved customer profiles. See Authorize.Net recurring billing and saved cards.

If more than one person takes payments, don't share one login. Give each employee their own username and password with only the permissions their job needs.

• Separate logins show who ran, refunded or voided each payment, which helps with mistakes, disputes and internal theft.
• Limited permissions keep staff who only take orders away from refunds, account settings, fraud filters and API credentials.
• Remove access the day someone leaves. A former employee with a live login can still issue refunds.

The user settings in the Merchant Interface list the roles and permissions available on your account. If you're not sure which to pick, ask your provider or Authorize.Net's support.

The gateway. Authorize.Net's pricing page, checked September 27, 2026, presents the virtual terminal as part of the gateway ("Accept payments through a Virtual Terminal or digital wallet from anywhere") and doesn't list a separate fee for it. Its direct Gateway Only plan is $25 a month, 10¢ per transaction and a 10¢ daily batch fee. Those are Authorize.Net's own direct prices, not START's. When the gateway comes through a merchant services provider, that provider sets the gateway fee. Our Authorize.Net pricing and fees guide breaks the full list down.

The merchant account. This is the bigger part of the bill. Card networks usually charge higher interchange (the base fee paid to the card-issuing bank) on keyed-in, card-not-present payments than on cards dipped or tapped in person, because the fraud risk is higher. Every virtual terminal sale is priced as card-not-present, even if the customer is standing at your counter.

With interchange-plus pricing, you see those card costs as they are, plus your provider's fixed markup, so it's clear what keyed sales really cost you. That's how START prices the merchant accounts we set up alongside Authorize.Net. Tell us how many of your payments are keyed in, and we'll tell you what to expect.

A virtual terminal works well for occasional phone, mail and invoice payments. It starts to strain in a few cases:

• Customers pay in person. Keying a card that's in front of you costs more and protects you less than dipping or tapping it. Look at a virtual POS or a card reader instead. Our guide to Authorize.Net mobile payments covers the app, readers, Tap to Pay and their processor limits.
• You key in dozens of orders a day. If customers could order online themselves, a website checkout saves staff time and keeps card numbers out of your hands. See shopping carts that work with Authorize.Net and the ways to connect a website.
• You bill the same customers every month. Scheduled billing from saved profiles beats re-keying cards or ticking the recurring box.
• You don't have a merchant account yet. The virtual terminal needs one behind it to move money. See getting an Authorize.Net merchant account.

START has worked with Authorize.Net for more than 20 years and has set up over 60,000 Authorize.Net accounts. We set up the merchant account and the gateway together, so the virtual terminal comes with the account.