Manual entry is a card-not-present transaction. That distinction matters. Pricing, fraud exposure, and dispute liability can all look different from a chip or tap transaction. The PCI Security Standards Council defines a virtual terminal as browser-based access to an acquirer's or processor's website where a merchant manually enters payment data for authorization — the terminal itself never reads the card directly, according to PCI DSS v4.0.1.
This guide to manual credit card processing covers what to prepare, the actual entry sequence, the security checks worth running, common mistakes, and when a different payment method makes more sense.
Key Takeaways
- A virtual terminal handles authorized card-not-present sales; it is not a substitute for an EMV terminal.
- Collect amount, card number, expiration, billing address, ZIP, and CVV (if supported) before submitting.
- AVS, CVV checks, and fraud filters reduce risk, but none confirm the caller is the real cardholder.
- Never store full card numbers or CVV codes in notes, spreadsheets, email, or paper files.
How to Manually Enter a Credit Card Payment Using a Virtual Terminal
The sequence below reflects the standard workflow across most processor platforms, including Clearwater Processing's virtual terminal, which you can access from any internet-connected device.
Step 1: Sign In and Confirm the Transaction Context
Log in through your processor's official portal using your own authorized account. Never use a shared login. Confirm you're working under the correct merchant location, and that this type of transaction is actually permitted under your processing agreement.
- Pull up the invoice, order number, or customer account reference before you touch the card fields
- Avoid public computers, unsecured Wi-Fi, or any workstation you wouldn't trust with a bank login
- Match the transaction to a business record instead of jotting details into an internal note
Step 2: Enter the Sale and Cardholder Information
Select the correct payment or keyed-entry option first. Enter the exact amount, invoice reference, and any tax or tip fields before you move to the card itself.
Then enter, in order:
- Card number
- Expiration date
- Cardholder name
- Billing address and ZIP code
- CVV (requested verbally, never written down)
Ask the customer to read the CVV directly rather than relaying it secondhand. Once the authorization goes through, that code should disappear from your workflow entirely.
Step 3: Run Available Verification and Submit the Authorization
Before you hit submit, double-check for transposed digits, a mistyped expiration date, or an accidentally selected recurring-payment option. These are the errors that generate the most avoidable declines and disputes.
Run the AVS, CVV, and fraud-filter tools your platform offers. A mismatch doesn't automatically mean fraud, but it's a signal to pause, not override. Submit the transaction once, then wait for the response. Record the approval code, not the card data.
Step 4: Confirm the Outcome and Provide Documentation
Check that the response actually says approved — not "submitted," "pending," or "declined." Verify the approved amount matches your invoice or order.
- Send a receipt through your processor's built-in email or text function
- Never email a card number or CVV, encrypted or not
- Note next steps for refunds, voids, or recurring billing before closing the ticket
Step 5: Reconcile and Monitor the Payment
Confirm the transaction shows up in your virtual terminal's history and gets swept into the next settlement batch. Match it against your invoice or accounting system, and check that the deposit and fees line up.
Keep an eye on repeated declines, unusual keyed transactions, and any chargebacks. Catching these early is a lot easier than untangling them later. Clearwater's merchant reporting portal, for example, provides comprehensive reporting on transaction history and settlement activity for exactly this reason.
When Should You Manually Enter a Payment, and What Do You Need?
Manual entry fits legitimate card-not-present scenarios: phone orders, service deposits, invoice payments, reservations, and back-office billing. It should not be your default for an in-person sale when an EMV terminal is available. Chip and contactless acceptance offer stronger card-present verification and different dispute protections.
Equipment and System Requirements
Confirm these with your processor before relying on manual entry as a regular workflow:
- Active merchant account with virtual-terminal function enabled
- Supported browser or app on a secured device
- Reliable internet connection
- Appropriate staff permissions (not a shared admin login)
- Receipt capability and access to transaction reporting
Inputs, Materials, or Conditions
Gather this before you start keying anything in:
- Customer authorization for the charge
- Sale, invoice, or order details
- Exact amount
- Card number, expiration date, cardholder name
- Billing address and ZIP code
- CVV, when your processor's rules permit collecting it
Skill, Safety, or Compliance Readiness
Staff need training on PCI DSS responsibilities, phishing awareness, customer verification, and what to do with declines, refunds, and chargebacks. The prohibition on storing CVV or unnecessary card data isn't optional — it's a compliance requirement, not a suggestion.
When manual entry is part of daily billing, merchants also compare processors on virtual-terminal tools, PCI support, and reporting.
Key Security Checks, Variables, Mistakes, and Troubleshooting
Approval depends on more than the card number. Transaction type, entered data, AVS/CVV results, fraud controls, and issuer decisions all play a role in whether a keyed payment goes through.
Card-Not-Present Verification
Accurate billing address, ZIP code, and CVV entry reduce risk. They don't eliminate it. An AVS or CVV mismatch is a screening signal, not proof of fraud, and a match is not proof of legitimacy either.
Card-not-present fraud on debit cards climbed from 26.1 basis points in 2019 to 41.6 basis points in 2023, according to research from the Federal Reserve Bank of Kansas City. The figure is debit-specific, and it still shows why keyed transactions need extra scrutiny.
Transaction Classification and Amount
Keyed, card-not-present transactions often carry different pricing and risk treatment than card-present sales. Watch for:
- Unusually large payments relative to a customer's typical order
- Repeated attempts in a short window
- Rushed requests to "just process it now" without normal documentation
Any of these warrants a second look before submission.
Staff Access and Data Handling
- Use unique logins per staff member, not shared credentials
- Enable multi-factor authentication where your processor supports it
- Keep screens private and devices locked when unattended
- Never record card numbers or CVV in chat, email, spreadsheets, or customer notes
Common Mistakes and Troubleshooting
| Issue | Likely Fix |
|---|---|
| Incorrect card details | Recheck digits with customer before resubmitting |
| AVS/CVV mismatch | Pause and confirm billing info rather than override |
| Duplicate submission | Check transaction history before charging again |
| Wrong transaction type selected | Void and re-enter correctly, don't stack charges |
| Declined payment | Ask customer to contact their issuer instead of repeated retries |
If a customer claims a payment failed, check your transaction history first. Don't run it a second time on assumption.
Visa's merchant dispute guidelines note that missing valid authorization and duplicate processing are common dispute triggers, and missing a response deadline can block a successful defense, per Visa's Dispute Management Guidelines. For retention and refund rules on your account, follow your processor's documentation. Compliance requirements are not identical across every provider.
Alternatives to Manually Entering Card Details
Manual entry solves a specific problem, but it involves more staff handling of card data than methods where the customer enters their own details.
Payment Links or Online Invoices
Sending a secure payment link lets the customer type their own card information directly into a hosted page. This reduces how much card data your staff touch and often produces a cleaner payment reference. The trade-off: customers can sit on a link for days, and someone has to manage follow-ups.
EMV Terminal or Mobile Card Reader
For any face-to-face sale, a chip or contactless-capable terminal is the better call. It provides stronger card-present verification and different dispute protections than a keyed entry ever will. You still need the hardware, plus connectivity and setup.
Ecommerce Checkout, Recurring Billing, or Integrated Payment Environment
For repeated or higher-volume payments, a website checkout, recurring billing tool, or accounting integration usually beats keying in each transaction by hand. Clearwater's back-office billing and QuickBooks/Xero integrations, for instance, are built to automate exactly this kind of repeat collection and cut down on manual reconciliation. Clearwater can also automatically update customers' cards that are about to expire, which saves time and retains revenue that would otherwise slip away to failed recurring charges.
Choosing a More Broad Merchant Services Setup
When comparing providers, look past the sticker price:
- Card-present and card-not-present pricing structures
- PCI compliance support and breach protection
- Reporting depth and funding schedule
- Fraud tools and available integrations
- Actual customer service, not just a sales pitch
How Clearwater Processing Supports Keyed and Remote Payments
When manual entry is only one part of how you get paid, Clearwater Processing sets up its virtual terminal alongside ecommerce gateways, back-office billing, and stand-alone terminals, so each payment can run through the most suitable channel. Because keyed sales carry card-not-present risk, its PCI compliance program and $100,000 breach protection insurance help protect the card data you handle, and Clearwater works directly with merchants to mitigate chargeback losses. Next-day funding keeps phone and invoice payments from slowing cash flow. If a keyed charge needs attention, clients have a single point of contact: a dedicated representative with industry experience they can reach on a personal cell number, a real person rather than a chat box, backed by 24/7/365 U.S.-based backend phone support.
Conclusion
A virtual terminal helps businesses accept authorized phone, invoice, and remote payments when a customer can't use a terminal or online checkout. It's a useful tool, but it works best as one option in a broader payment setup—not the default for every transaction.
Manual entry stays reliable when you lock in a few habits:
- Enter card data carefully and run AVS/CVV checks
- Limit who can access the virtual terminal
- Use secure receipts and reconcile every batch
Prefer card-present or customer-entered options whenever they're practical. Choose a processing environment that balances security, usability, and cost for how your business actually operates.
Frequently Asked Questions
How do manual credit card machines work?
A virtual terminal or manual credit card machine sends keyed card details to the processor, which routes the request for authorization and returns an approval or decline. That sale is card-not-present, so pricing and dispute rules differ from a swiped or dipped transaction.
What stores allow manual credit card entry?
Businesses with an enabled virtual terminal or keyed-entry function can accept manual payments: service providers, phone-order retailers, professional practices, contractors, and B2B firms. Processor approval and security requirements still apply.
What is a credit card processor?
A processor routes transaction data among the merchant, acquiring bank, card network, and issuing bank, handling authorization, settlement, and reporting along the way. It's distinct from the acquirer and issuer, even though some providers package these roles together commercially.
