Impersonator scams produced $2.6 billion in reported losses in 2022, the largest category of fraud complaints that year. Most of those calls went to consumers. A growing share now goes to the businesses those consumers buy from, which is the part a small company discovers the first time a polite caller places a large order and asks for it to be shipped somewhere unusual.
Taking a card over the phone is ordinary work and has been for 40 years. What has changed is the quality of the impersonation on the other end, and the size of the loss when the transaction turns out to be somebody else’s card.
The Phone Order Script
A repeatable script does more for accuracy than any software setting. Ask for the name exactly as printed on the card, the billing ZIP code, the expiry, and the 3-digit security code, in that order, and enter each one as it is spoken instead of writing it on a pad to type later.
Read the total back before submitting, and say the business name as it will appear on the statement. A customer who hears “Riverside Plumbing LLC” on the call recognizes it 30 days later, and a descriptor nobody recognizes is one of the most common causes of a dispute on a legitimate sale.
End the call with the transaction reference and the email address the receipt is going to. Two minutes of structure removes most of the friction that follows a keyed payment.
Storage Limits on Card Details
The security code has the tightest rule attached to it. It may be used to authorize a payment and never stored afterward, in any form, which includes a sticky note, a customer record, a spreadsheet, and a saved call recording.
Businesses that record calls for training run into this immediately. The workable approach is pausing the recording while the card details are read, then resuming, and most phone systems sold to small businesses support it. A recording that captures a security code turns an ordinary phone archive into a cardholder data store, with all the obligations attached.
Handwriting the number fails the same test. A notepad by the till, with digits waiting to be entered when things quiet down, is how most small breaches start. It outlives the phone call, the cleaner, and the recycling bin, and it names the business on the same page.
A Form for Keyed Payments
A business taking regular phone orders uses virtual terminals for payment card processing so staff can key the details into a browser form while the caller waits, which keeps the number off paper and files the result against that customer’s own record.
Authorization and capture are separate steps when goods ship later. Authorize the amount during the call to confirm the funds and the details, then capture when the order leaves the building. An authorization left for a week can expire, and a capture against an expired hold becomes a fresh attempt the issuer may decline for reasons that have nothing to do with the customer’s balance.
Two settings are worth turning on before the first call. Require the security code and billing ZIP on every entry, and switch on the option that flags a mismatch instead of approving quietly, because a partial address match on a $4,000 order is information somebody should see before the goods ship.
Caller Verification Before the First Order
The volume of nuisance phone calls rose again through the last quarter measured, with automated tools placing a growing share of them. Caller ID is not evidence of anything, since the number shown is set by the caller. For a first-time customer placing a large order, the protection is a procedure the staff follow. Take the order, then call back on a number the business finds independently, and ship to the billing address on the card unless there is a written reason to do otherwise. Fraudulent orders almost always need an alternative delivery address, and asking for one politely is the cheapest screening question available.
Voice Impersonation of Known Customers
Familiar voices no longer prove much. AI voice scams have taken money from families who heard a relative in distress, built from short voice samples posted publicly, and the same tools work against a supplier relationship where the accounts contact has a conference talk online.
For a business, the exposure is a caller who sounds like a regular client asking to put a rush job on the card already on file. A short verification habit handles it. Confirm one detail the real customer would know and a caller could not look up, such as the invoice number from the last job or the address of the property the work was done at. Written into a procedure, it costs 15 seconds and survives staff turnover.
Small Test Charges and Card Testing
Stolen numbers are validated before they are spent. Fraud advisers describe small charges appearing on statements as a check that the card still works, sometimes for a few dollars, before a larger purchase follows.
A phone-order business sees the other side of that pattern. A caller who wants to run a series of small amounts across several cards, or who asks to split a payment over four numbers, is describing a card-testing session rather than a purchase. One card per order, one order per call, and a manager check on any split payment removes almost all of it.
Sources of Stolen Numbers
The caller reading digits may be perfectly legitimate and reading a number that is not theirs. Card details reach criminals through phishing, skimmers, malware on shopping sites, dishonest employees, and breaches, and a reporter asking how safe in your wallet a card really is found stolen details selling openly for a few dollars each.
This is why address verification and the security code matter on a keyed sale. Neither proves the caller owns the card, and together they raise the effort enough that most opportunistic attempts move on. The business that also keeps a dated order record, a delivery signature, and the email trail has the evidence to answer a dispute when one arrives anyway.
The Callback Rule
Of the $2.6 billion lost to impersonators in a single year, almost none of it required sophisticated technology on the criminal’s side. It required a person who answered a phone and acted on what the voice said.
One rule prevents most of it in a small business. Any request that arrives by phone and involves a card number or a change of bank details gets confirmed on a return call, placed to a number the business already had. Staff can apply it without exception, and customers rarely object once they hear the reason. The whole procedure is one phone call placed in the other direction.
#Process #Credit #Cards #Phone