Taking phone orders, invoices and deposits with a payment link
A payment link gets a phone or email order paid on a hosted card page, with no card number read out. When it beats a card machine, what the customer sees, the distance-selling and PCI rules, fair deposits and the VAT invoice. Checked 9 November 2026.
This is for the shop, workshop or showroom that takes orders by phone or email and wants to be paid without a card machine or a week of “has the transfer gone through?” emails. By the end you will know when a payment link beats the alternatives, what the customer sees, what the law expects of a sale made by phone, and how to take a deposit fairly. Every rule is as it stood on 9 November 2026, linked to the page we read it on. Disclosure: we build Orbit Commerce, whose dashboard does the flow described here, so weigh the Orbit parts accordingly. This is general information, not legal or tax advice.
In short
- A payment link is a web address you send by email or text; the customer pays on the payment provider’s card page, so no card number is read out or written down.
- Reading card numbers down the phone is legal but brings your staff, phone system and notepad into scope for PCI DSS, the card industry’s security standard, with no 3D Secure on the payment.
- A phone or email sale to a consumer is a distance contract: Schedule 2 information, confirmation on a durable medium, 14 days to cancel unless an exception applies.
- In Orbit a phone order is a draft order paid by payment link, payment-due invoice or mark as paid, on every plan; a hand-agreed deposit is its own draft order with a custom line.
When does a payment link beat a card machine?
A card machine suits a customer standing in front of you. On the phone or by email you have three other ways to get paid, and they differ most in who handles the card number.
| Way to get paid | Who handles the card number | What you chase | Fits best |
|---|---|---|---|
| Card machine, in person | The customer, on the terminal | Nothing | The counter and the van |
| Card details read out on the phone | Your staff: they hear it, type it, sometimes write it down | Declines now, fraud disputes later | Businesses verified for keyed-in payments |
| Bank transfer | Nobody | The transfer: wrong reference, wrong amount, “sent it yesterday” | Large sums and trade accounts |
| Payment link to a hosted card page | The customer, on the provider’s page | A click, before the link expires | Phone and email orders, deposits, trade buyers paying by card, collections |
The link wins in four places:
- Phone orders, because nobody reads sixteen digits down a crackly line.
- Invoices, because paying is one click.
- Hand-agreed deposits, because it collects exactly the sum agreed against a line that says what it is for.
- Collections, so the goods are paid for before the customer walks in.
How does a payment link work, and what does the customer see?
Here is the flow in Orbit; other platforms differ in detail.
- Build the order by hand. Create order lets you search the catalogue, add a custom line for anything that is not a product, set the delivery method, including collection, and apply a discount. A new caller’s customer record is created from inside the order. Save it as a draft until they confirm, or duplicate a past order for a regular.
- Choose how they pay. Copy the payment link into an email or a text; it works for 7 days. Or tick Send invoice to email a payment-due invoice that carries the link. Or mark the order paid when a bank transfer lands.
- The customer pays. The link opens their order page on your storefront, with the items, delivery and total. They pay on the same Stripe-hosted card step as every customer at your checkout, so the card number never touches your shop or Orbit, and 3D Secure runs when the card issuer asks for it.
- After payment. The order leaves your Unpaid view, and if your store has a VAT registration number the VAT invoice is emailed the moment payment is captured. Until the order is paid and shipped you can still edit it, with every change on the timeline, and a refund goes back to the card it came from.
Can you take card details over the phone?
Yes, it is legal, but it brings a compliance cost. The PCI Security Standards Council’s guidance on telephone payments says that if “the person answering the call writes down the account data” the business’s “processes and environment would be considered in scope for PCI DSS”. It adds that sensitive authentication data such as the card security code “must not be stored after authorization, even if encrypted” (PCI SSC telephone payments guidance, version 3.0, November 2018, read 9 November 2026). The shortest self-assessment, SAQ A, is for merchants whose account data functions are “completely outsourced to PCI DSS validated and compliant third parties” (PCI SSC, 30 January 2025), which is where a hosted payment page keeps a small business.
There is a fraud angle too. Stripe’s guide says “Card details collected over the phone fall outside the scope of SCA and do not require authentication”, and that where an exemption is used “the liability of fraudulent disputes stays with the business” (Stripe, Strong Customer Authentication guide, read 9 November 2026). Stripe’s documentation on mail order and telephone order (MOTO) payments says “Before you can enable MOTO transactions, Stripe must verify that you’re PCI compliant” (Stripe docs, read 9 November 2026). In Orbit the customer always enters the card themselves, on the hosted page.
What does the law say about a sale made by phone?
If your customer is a consumer, a sale agreed by phone or email is normally a distance contract under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. That means one made “under an organised distance sales or service-provision scheme” using only distance communication up to the moment the contract is made (regulation 5, checked 9 November 2026).
| Rule | What it asks of you | Where (read 9 November 2026) |
|---|---|---|
| Information before they commit | The Schedule 2 list “in a clear and comprehensible manner”: your identity and address, the total price with taxes, delivery charges, payment and delivery arrangements, the right to cancel, return costs, and any deposit and its conditions | Regulation 13 and Schedule 2 |
| Confirmation on a durable medium | Within a reasonable time, no later than delivery of goods and before a service starts, with the Schedule 2 information unless already given that way; paper and email both count | Regulation 16 |
| 14 days to cancel, refund in 14 days | Ends 14 days after the day the goods arrive, or the day a service contract is made; up to 12 months later if you never told them about the right. Refund “using the same means of payment as the consumer used”, with no fee | Regulations 30, 31 and 34 |
| No right to cancel | Goods “made to the consumer’s specifications or are clearly personalised”, goods that “deteriorate or expire rapidly”, a visit the consumer requested for urgent repairs, and accommodation, catering or leisure services for a specific date | Regulation 28 |
The email that carries the payment link is your durable medium: if it states the order, the price, your address and your cancellation terms, the confirmation is done. Never skip the right-to-cancel line; the penalty is a cancellation window that can run for a year. A business customer sits outside these rules; your own terms apply.
How do you take a deposit fairly?
If a consumer pulls out after paying a deposit, Part 2 of the Consumer Rights Act 2015 decides whether you may keep it. An unfair term “is not binding on the consumer”. A term is unfair if “contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations under the contract to the detriment of the consumer” (section 62, checked 9 November 2026). The Act’s list of terms that may be unfair includes one “permitting the trader to retain sums paid by the consumer where the consumer decides not to conclude or perform the contract” with nothing equivalent coming back if the trader cancels (Schedule 2, paragraph 4).
The CMA’s guide for businesses (last updated 22 July 2026) says a term is unlikely to be fair if it lets you “make prepayments non-refundable, regardless of why the customer cancels”. It is more likely to be fair if the sums you keep “reflect a genuine estimate of what you will lose directly because of the customer cancelling”. It also says “you may legitimately keep a deposit in full if it’s no more than a small percentage of the price and you make it clear when exactly it would be non-refundable” (CMA, Writing a fair contract for customers, read 9 November 2026).
In Orbit, the storefront charges the full price of a product at checkout. A deposit the business agrees by hand is its own draft order with a custom line that says what it is for, such as “Deposit, kitchen fitting, 3 March”, sent to the customer as a payment link. The balance is a second order later, or a payment-due invoice. That makes two orders, each with its own date, payment and VAT invoice. Put the terms in the custom line and the email: what the deposit is for, the balance and its due date, when it comes back in full, and when you keep part of it and why. If you cancel, refund it.
On VAT, HMRC says “Most deposits serve primarily as advance payments” that create a tax point (the date a sale counts for VAT) when received. It adds that VAT is still due on a deposit you keep when the customer fails to take up the goods or service (VAT Notice 700, paragraphs 8.13.1 and 14.2.3, updated 25 June 2026, read 9 November 2026).
Bank transfers, mark as paid and chasing the link
Some customers will always prefer a bank transfer, and for a large trade order so might you, since it costs no card fee. Orbit treats it as a payment you record yourself: build the order, send the invoice, and mark the order paid when the money lands. Refunds on such payments are recorded on the order, with switches to restock the items and email the customer.
Chasing is where the link earns its keep. The Orders list has an Unpaid view and a payment-status filter, so the morning check is one click, and a comment on the order timeline with Notify customer ticked goes to the customer by email. If the customer sits on the link, copy it again or re-send the invoice; if they never pay, cancel the order.
For the books, a link-paid order is a card order like any other. Three guides cover it: payouts, fees and tax; ecommerce bookkeeping in the UK, for Xero and QuickBooks; and what a payment gateway really costs a UK small business, for other platforms. The fee is one published card rate per plan, with nothing added on top: 2% + 25p on Solo for a UK personal Visa or Mastercard.
A script for the phone
Most of the law above is satisfied by saying six things and sending one email.
- Repeat the order back. Items, quantities, sizes or finishes, each price including VAT.
- Delivery or collection. The address, the charge and the date, or the collection point.
- The total. Including VAT, and for a deposit the balance and when it falls due.
- Who you are and the cancellation terms. Your trading name and address go in the email; say whether they have 14 days to cancel or, for a made-to-order item, that they do not, and why.
- How they pay. “I’ll email you a link to pay by card on a secure page, or pay by bank transfer against the invoice and I’ll mark it paid.” Never ask for the card number.
- What happens next. The email with the link, the order page they can check, and the VAT invoice that follows payment.
Then send the email: the order, the total, your address, the cancellation terms and the payment link. That one message is the confirmation, the right-to-cancel information and the payment request.
Where Orbit fits
Everything above that happens inside the dashboard is on every Orbit plan, from Solo at £25 a month (£19 a month billed yearly, ex VAT), with a 14-day free trial and no card to start. That covers draft orders with payment links, payment-due invoices and mark as paid on the orders page; the Stripe-hosted card step, the published card rate per plan and bank transfer as an offline method on payments. It also covers VAT invoices emailed on payment and itemised payouts on finance; click and collect as a local pickup method on fulfilment; and Nebula, the dashboard assistant, which can draft the order.
The Xero and QuickBooks plugins are add-ons from the plugin store. A hand-agreed deposit is a draft order with a custom line and a payment link, as above, with the balance as a second order or an invoice. For a showroom, a venue or a trade counter, read kitchen and bathroom showrooms online, a wedding venue website that sends the payment link and taking a trade counter online.
Read next: quote forms and price calculators for a trade website, a holiday cottage website that takes direct enquiries and selling fixed-price design and marketing packages.
Questions people ask about phone orders and payment links
Can I take card payments over the phone without a card machine?
Yes. Build the order in your dashboard and send the customer a payment link by email or text; they open it, see their order and pay by card on the provider’s hosted page, so nothing is keyed in at your end. In Orbit the link works for 7 days and leads to the same Stripe-hosted card step as your checkout.
Is it legal to take card details over the phone in the UK?
Yes, but it brings your staff, phone system and any notes or recordings into scope for PCI DSS, the card security code must never be kept after authorisation, and a keyed-in payment runs without 3D Secure, so a fraudulent dispute stays with your business. A hosted payment page keeps card numbers out of your hands.
How long does an Orbit payment link last?
It lasts 7 days from when you copy it. If the customer has not paid by then, copy the link again or re-send the payment-due invoice: a link close to running out is renewed, and the one the customer holds keeps working. A cancelled order gets no payment link.
How do I take a deposit through my Orbit shop?
A deposit you agree with a customer is its own draft order with a custom line saying what it is for, sent as a payment link. The balance is a second order or a payment-due invoice later, and the deposit and the balance each have their own payment and VAT invoice. Anything bought at the storefront checkout is paid in full there.
Can a customer cancel an order they placed by phone?
Usually, for 14 days after the day the goods arrive, or the day a service contract is made, and up to 12 months longer if you never told them about the right. There is no right to cancel goods made to their specification or clearly personalised, goods that perish quickly, urgent repairs they requested, or catering, accommodation and leisure services for a specific date.
Start a 14-day free trial, no card required, create a draft order with a custom line, copy the link and open it on your phone: that is the page your customer sees.