Questions to Ask When Comparing Virtual Terminals (Before You Commit to One)
A virtual terminal looks simple from the outside: a login screen, a few fields, a Submit button. Behind that simplicity sits the system that handles card-not-present revenue for phone orders, emailed invoices, mail-order accounts, and repeat customers. Choosing the wrong one shows up months later as chargebacks you cannot fight, refunds you cannot trace, or reports that never quite match your bank deposit. Before you sign anything, run every shortlisted provider through a structured set of questions — and make them answer with specifics rather than reassuring adjectives.
Security and compliance questions to ask before you key a single card
Start with the uncomfortable part: your virtual terminal will hold or pass through some of the most sensitive data your business touches. Ask each provider whether they are a PCI DSS Level 1 service provider — the highest validation level — and whether they hold independent attestations such as SOC 2 Type II for operational controls. A provider that is merely “PCI compliant” as a merchant is answering a different question than one validated as a service provider. You want the latter.
Next, ask how card data is protected at every step. Does the terminal use tokenization so that saved cards become reference tokens rather than stored numbers? Is all traffic encrypted in transport? Can your staff key a card directly into the terminal without the number ever being written on a callback slip or pasted into a CRM? That last point matters more than most merchants realise: the safest virtual terminal is one that makes not storing card numbers the path of least resistance.
Then dig into fraud controls and user governance, which are where comparison shopping usually separates serious providers from thin ones:
Address Verification (AVS) and CVV checks. Are both available on every keyed transaction, and can you decide which results you will accept? 3-D Secure where the card issuer supports it? Ask how the terminal handles an AVS mismatch — does it warn the operator before submission, or silently process and leave the dispute to you?
Role permissions. Can you restrict key-entry, refunds, and voids to named users? A virtual terminal shared under one master login is an audit nightmare. You want granular permissions, and you want the ability to revoke access the day someone leaves.
Session controls. Do sessions time out automatically when a browser is left open on a counter? Are exportable audit logs available showing who processed, refunded, or voided what and when?
Retention and receipts. Are instant email receipts generated by the platform? Can you control what appears on them? Ask where transaction records live, for how long, and how you export them if you change providers.
Merchants researching this space often ask, Which provider has the best virtual terminal features? — and the honest answer is that the “best” one is whichever answers all of the above with documentation rather than a sales deck.
Functionality and workflow questions that decide your daily speed
Once security is settled, shift to the work itself. A virtual terminal is a productivity tool, and small friction compounds across hundreds of keyed orders. Ask for a live walkthrough rather than a screenshot tour, then test the exact scenarios your team runs every week.
Phone and mail order flow. How many clicks from opening the terminal to a completed MOTO sale? Can an operator search for an existing customer and reuse their saved card from a customer card vault instead of re-keying? Re-keying is where both errors and disputes are born.
Repeat and recurring charges. Can you set up recurring schedules from saved cards — weekly service contracts, monthly retainers, instalment plans — and pause, edit, or cancel them without contacting support? Does a failed scheduled charge trigger a retry, and who gets notified?
Invoicing and payment links. For email-driven sales, does the terminal connect to branded pay-by-link URLs with expiry dates, single-use limits, amount locking, or partial payments? Can the buyer’s PO number or job reference ride along with the payment so receivables clear invoice by invoice? B2B and wholesale sellers should press hard here: part payments traceable to the same invoice is a feature, not a nice-to-have, when a customer pays a deposit and a balance weeks apart.
Reporting and reconciliation. Can you filter transactions by operator, date range, card type, or reference, and export the result? Do the totals tie back to deposits, or does someone rebuild the month in a spreadsheet? Ask whether in-person, online, and keyed sales appear in one merchant dashboard or three separate logins.
Integrations. If you run software — a booking system, an ERP, a field-service app — ask about APIs, webhooks, and a sandbox for testing before go-live. A sandbox is the fastest way to find out whether a provider’s documentation is real.
Devices and browsers. Does it work on the browsers your staff actually use, including on a tablet at the counter or a laptop at a trade show? Ask about mobile browser behaviour, not just desktop.
Pricing, contract, and support questions that protect your margins
Cost is where comparison tables get fuzzy. Insist on a full picture of every line item, not just the headline rate, and ask how that rate is structured. Interchange-plus pricing separates the card network’s cost from the processor’s markup, which makes your statement readable; bundled or tiered pricing tends to bury the difference. Ask whether the quoted rate applies to keyed transactions specifically — card-not-present pricing is often its own category.
Then list every possible fee and ask which ones apply to you: monthly account fees, per-transaction fees, gateway or virtual terminal access fees, statement fees, batch fees, refund fees, chargeback fees, and any penalty for PCI non-compliance. Ask what happens when a customer disputes a keyed transaction — is there a chargeback tool with dispute alerts, deadline tracking, reason-code guidance, and evidence packs assembled from transaction, authorisation, and delivery detail? Without delivery proof and a response deadline in front of you, a winnable dispute becomes a loss by default.
Contract terms deserve the same scrutiny. Ask about minimum monthly volume commitments, early termination penalties, hardware bundling, and how much notice you must give to leave. Request a sample statement or, better, ask the provider to review your current one against their pricing so the comparison is apples to apples rather than estimates. If a provider offers a statement comparison, use it — the delta is usually in the fees nobody mentioned on the call.
Support questions decide what happens at 4:55 p.m. on a Friday when a large order will not authorise. Ask about support hours, whether you reach a person or a queue, response-time expectations, and whether you get a dedicated account manager or a shared inbox. Ask about onboarding: who configures user roles, tests a live transaction, and trains your team? Ask for uptime commitments and whether a public status page exists.
Finally, weigh geography and currency. If you sell across Canada and the United States, confirm the provider supports merchants in both markets, settles in the currencies you invoice in, and understands cross-border card behaviour. Ask for references from businesses in your industry and your size band — a restaurant keying occasional phone orders has different requirements than a wholesaler processing net-term invoices weekly.
