Most offices still take orders over the phone, and plenty still take them by fax, email, or mail. A longtime client calls in a reorder, an administrator keys the card number into a virtual terminal, and the invoice closes before lunch. It feels routine because it is routine, and that familiarity is exactly what makes the channel attractive to people who steal card numbers for a living.
Card-present fraud has gotten genuinely hard. The chip in a physical card generates a one-time cryptogram for every dip or tap, so a cloned magstripe is close to worthless at a modern register. Fraud did not evaporate when that happened. It migrated to the channels where nobody can hold the card or read a customer's face, and mail order and telephone order sits squarely in that territory.
The frustrating part is that most of the damage is preventable using controls that already ship inside the gateway your business pays for every month. Address verification, CVV enforcement, velocity limits, and a screening layer that scores an order before it authorizes will stop the large majority of what reaches a small back office. The work lies in configuring them deliberately instead of trusting your processor's defaults.
The Quiet Gap That Chip-and-PIN Left Behind
When EMV rolled out across the United States, counterfeit losses at the point of sale fell sharply, and the fraud economy did the sensible thing by going looking for softer targets. The PCI Security Standards Council made that shift explicit when it updated its guidance on protecting telephone-based payment card data, noting that criminals increasingly exploit card-not-present channels such as mail order, telephone order, and e-commerce precisely because card-present attacks stopped paying.
A phone order hands a fraudster everything a cloned card no longer can. There is no cryptogram to forge, no PIN pad to defeat, no clerk comparing a face to a photo. All that stands between a stolen number and a shipped pallet is whatever your staff decides to ask, and under deadline pressure staff tend to ask less. The Federal Reserve Payments Study tracks just how much value now moves across card networks each year, a useful reminder of how large that pool is.
How Organized Rings Actually Work a Phone Order
They rarely open with the card. They open with reconnaissance: one call about stock and lead times, a second to confirm you accept cards by phone, a third to learn whether you ship anywhere other than the billing address. None of it trips an alarm, because none of it is a transaction.
Then the real order arrives, shaped to clear your weakest check. Shipping goes to a drop address or a reshipping mule. The amount sits just under whatever threshold they suspect triggers manual review. The caller is warm, slightly rushed, and has a tidy explanation ready for the address mismatch. The FBI's Internet Crime Complaint Center publishes annual reports on the complaint volume behind schemes like these, and the same pattern of patient reconnaissance followed by one tightly engineered request shows up year after year.
Address Verification and CVV Rules Worth Enforcing
AVS compares the billing address your caller recites against what the issuer holds on file, and it returns a response code rather than a verdict. That distinction matters, because a gateway configured to approve on any AVS response whatsoever is not really running AVS. Decide in advance which codes you accept, which route to review, and which you decline flat, then write it down.
CVV is simpler and gets skipped far more often. Those three or four digits are never stored in a compliant merchant system, which means a fraudster working from a breached database usually does not have them. Requiring CVV on every keyed sale, with no courtesy exceptions for familiar customers, removes a wide slice of exposure for the price of one extra question. A properly configured MOTO payment processing setup lets you enforce both as hard gateway rules, so protection stops depending on whoever happened to pick up the phone.
Screening in Real Time Instead of Reconciling After the Fact
Static rules catch last year's fraud. Real-time scoring reads the whole shape of an attempt: device and IP reputation, how many distinct cards have hit your account in the past hour, whether this billing ZIP and shipping ZIP have ever appeared together, how the basket compares against the customer's own history. An order can pass AVS and CVV cleanly and still look badly wrong on those dimensions, and that is precisely the order you want parked for ten minutes.
The economics are not close. A declined authorization costs you an awkward phone call. A chargeback costs you the goods, the revenue, a fee, and a tick against your dispute ratio, and enough ticks put the merchant account itself in jeopardy. Not every loss arrives from outside either, which is why DejaOffice's look at how businesses detect and prevent internal fraud belongs alongside your external controls rather than in a separate conversation.
Where That Leaves Your Back Office
Phone and mail order are not going away. For many businesses they are where the biggest, stickiest, most relationship-driven orders land, and switching them off to dodge fraud would cost far more than the fraud ever does.
The realistic goal is narrower: make your corner of the channel measurably harder to work than the next merchant's. Turn on the checks you already own, write down what each response code means for your team, let a scoring engine read every order before it authorizes, and keep evidence as a habit rather than a scramble.
Fraud operations are rational. They go where friction is lowest, and they leave when the math stops working. Add friction in the right four or five places and you stop being the soft target, which is most of what payment security ever buys anyone.