Manually keyed card payments: why typed-in card numbers attract fraud
Payments where the card number is typed in by hand skip the chip entirely. Why keyed and phone-order transactions are a fraud risk and how card controls can block them.
When a card number is typed into a terminal or a phone-order screen, none of the card's built-in security takes part. There's no chip to produce a one-time cryptogram and no contactless exchange. The payment rests entirely on details that can be copied, stolen or bought.
Where keyed payments happen
- In store, when a terminal can't read the card and the cashier types the number in.
- Mail order and telephone order (MOTO), where the customer reads out the card details.
- Some virtual terminals used by small businesses.
Why impostors like them
Stolen card details are worth most where the physical card isn't needed. Keyed entry lets an impostor use details from a breach or a skimmer at a terminal, without ever holding the card. For most cardholders, a keyed payment is rare enough that blocking it costs them nothing.
Card controls: let the cardholder decide
- Offer a per-card switch that declines manually keyed and phone-order payments.
- Default it on for programmes where keyed use is rare, and let cardholders turn it off when they need it.
- When a keyed payment is blocked, tell the cardholder straight away, so a fraud attempt becomes a reassuring notification rather than a surprise on the statement.
In 0Fraud, keyed-entry blocking is decided inside the authorisation and starts in shadow mode, so an issuer sees how many keyed payments their cardholders actually make before switching it on.