Taking phone bookings without writing card numbers down
Updated · HotelOne
In short
The safest way to take payment for a phone booking is not to hear the card number at all: send the guest a payment link and let them pay on their own phone. When you need a card to guarantee a booking, keep it in a card vault rather than on paper or in a spreadsheet — and never keep the CVV once the payment is authorised, which the card industry’s rules (PCI DSS) do not allow.
The problem with the notepad
A guest rings to book, reads out a 16-digit number, the expiry date and the three digits on the back, and someone at the desk writes them down. Two things can go wrong. A digit is misheard — a 5 taken for a 9 — and the charge fails when the guest is long gone. Or the paper stays at the desk, and with it everything needed to use the card.
What the card rules say
The Payment Card Industry Data Security Standard (PCI DSS) sets the rules for anyone who takes card payments. One of the clearest: the card verification code — the three or four digits printed on the card — may be collected to authorise a payment, but must not be kept once that payment is authorised. That holds even if it is encrypted, even if the guest says you may keep it, and for cards kept on file for later charges.
Payment links: the guest types the card, not you
Instead of taking the card over the phone, send the guest a link by SMS or email. They open it on their own phone, enter the card on the payment provider’s page, and the payment posts to the booking. Nobody at the property hears, writes down or stores the number.
- Use it for a deposit, the full balance or any amount you choose
- See at a glance whether the link is still waiting or has been paid
- A link that has expired or been cancelled can no longer be paid
Guarantee cards: let a vault hold them
Some bookings need a card on file — a late arrival, a no-show policy, a charge after the free-cancellation period. Keep it in a card vault: the card is typed into the vault’s own form, the PMS keeps only a token that can charge it, and the full number is shown only to authorised staff, with every view logged.
Delete stored cards once you no longer need them, and charge any balance or fee before then.
OTA virtual cards
OTAs such as Booking.com and Expedia often pay with a virtual card (VCC) that can be charged from a set date. Treat it like any other card: keep it in the vault, charge it on or after its effective date, and don’t copy its details anywhere else.
How HotelOne does it
HotelOne sends payment links by SMS or email from the booking — for a deposit, the balance or a custom amount — and the payment posts to the booking when the guest pays through eWAY. Cards are never stored in the PMS: they live in a card vault, and the PMS keeps a token that can charge the card, or show it once to a user who enters the hotel’s card view password. Every view is logged, the CVV can be shown only once, OTA virtual cards are brought into the vault automatically, and stored cards are deleted automatically after the stay. A charge on a guarantee card can be scheduled for a later date, with the guest’s consent recorded.
Payments in HotelOne PMSQuestions
- Can we keep the CVV to charge a no-show later?
- No. The card rules don’t allow the CVV to be kept after authorisation, even encrypted or with the guest’s permission, and it isn’t needed to charge a card on file. Keep the card in a vault and charge it from there.
- Are payment links safe for the guest?
- The guest enters the card on the payment provider’s page, not in a reply to you, so the number never passes through the property.
Sources
- PCI Security Standards Council, FAQ 1280: Can card verification codes be stored for card-on-file or recurring transactions? (October 2023)
- PCI Security Standards Council, FAQ 1319: Are merchants allowed to request card-verification codes/values from cardholders? (June 2025)