What kind of payment software do you need for phone orders, online checkout, or your own app?
Summary
Phone orders go through a virtual terminal, where staff type in the card number. Online orders go through a checkout page the customer fills in, and payments inside your own site or app go through an API. The choice changes the price: keyed sales cost more than tapped ones everywhere we looked, and an API build also decides how much PCI paperwork you take on.
Keyed entry carries a higher rate
| Provider | Card present | Keyed or manually entered | Fee on a $100 phone order |
|---|---|---|---|
| Square (Free plan) | 2.6% + 15¢ | 3.5% + 15¢ | $3.65 |
| PayPal POS | 2.29% + $0.09 | 3.49% + $0.09 | $3.58 |
| Stripe | 2.7% + 5¢ (Terminal) | 2.9% + 30¢, plus 0.5% for manually entered cards | $3.70 |
| Helcim | Interchange + 0.40% + 8¢ | Interchange + 0.50% + 25¢ | markup $0.75, plus interchange |
A business that takes most of its orders by phone is really paying the keyed rate, whatever the headline says.
Online checkout is not one price either
On Square's Free plan, online payments and invoices cost 3.3% + 30¢. Payments made through Square's online API cost 2.9% + 30¢ on every plan. The same web order can therefore cost 0.4% less if it comes through your own integration instead of Square's hosted tools. Recurring billing can carry its own charge too: Helcim adds 0.4% per recurring transaction.
What an API integration has to handle
Networks drop connections. If your server sends a charge, never hears back, and sends it again, the customer can be billed twice. Stripe's API accepts an idempotency key with each request so that a retry after a connection error does not create a second charge.
Some results arrive later. Stripe sends webhook events when a customer's bank confirms a payment, when a customer disputes a charge, or when a recurring payment succeeds. Without an endpoint listening for those, your order system and your money drift apart.
Then there is the card number itself. Stripe's PCI guide says that passing card details straight to its API means filling out SAQ D every year, which it calls the most demanding of the self-assessment questionnaires. Collecting cards through Stripe Checkout or Elements, where the fields are served from Stripe's domain, puts the business on SAQ A. The article on PCI DSS explains what those forms involve.
Sources
- squareup.com/help/us/en/article/5068-what-are-square-s-fees
- squareup.com/us/en/payments/our-fees
- paypal.com/us/business/pos-system/pricing
- stripe.com/pricing
- helcim.com/pricing
- docs.stripe.com/api/idempotent_requests
- docs.stripe.com/webhooks
- stripe.com/guides/pci-compliance
Related on this site
- Do you need a merchant account, a processor, and a gateway, or can one company cover all three?
- Why does a keyed-in or online card payment cost a merchant more than a tapped one?
- Do online card payments cost more than in-person ones?
- Does a small business still have to deal with PCI DSS if a processor handles the cards?
- The three numbers behind a card rate
- Effective rate calculator
Written by Kaz (pen name). Figures are copied from providers' published pricing pages on the dates shown. We have not used these products. Corrections: contact form.