Insight
PCI compliance virtual terminal: when one helps and when it does not
PCI compliance virtual terminal questions come from merchants who take payments by phone or mail. So the choice of tool shapes how much of PCI DSS applies to you.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What a PCI compliance virtual terminal is
A virtual terminal is a web page from your payment provider where staff key card details. The provider processes the payment, so your systems do not store the number.
However, the computer used for keying still matters. Malware on that device could capture every number typed.
Which questionnaire a PCI compliance virtual terminal usually means
Merchants who only key payments into a hosted virtual terminal often fit SAQ C-VT. Also, the provider must be PCI DSS validated, and the workstation must be isolated.
| Setup | Usual questionnaire |
|---|---|
| Hosted virtual terminal only | SAQ C-VT |
| Virtual terminal plus card reader | Often a different SAQ |
| Card numbers stored in your systems | SAQ D |
PCI compliance virtual terminal check
Tick what is true for every keying computer.
Your result appears here as you tick, so you can see what is still open.
Alternatives to a PCI compliance virtual terminal
Sometimes another channel removes even more scope. For example, sending a payment link lets customers enter their own details.
- Payment links sent by email or text
- Secure keypad entry while customers are on the line
- Hosted checkout pages for repeat customers
Keeping the workstation clean
Use a dedicated, patched computer for keying. Also block personal browsing and email on it, because those bring malware. As a result, the device stays a narrow, controlled path.
In addition, never write numbers down before keying. Staff should type them as the customer reads them.
Where Winslow helps
We compare channels, set up the workstation rules and prepare your questionnaire. We are not a QSA, so you sign your own attestation. Gap analysis generally runs $8,000 to $40,000. Forms are in the PCI SSC document library.
PCI compliance virtual terminal questions
Does a PCI compliance virtual terminal remove all obligations?
No. It reduces scope, but the keying workstation and policies remain yours.
Can staff use a PCI compliance virtual terminal from home?
Possibly, if home devices meet the same isolation rules. Most merchants find that hard to prove.
Is a PCI compliance virtual terminal better than payment links?
Payment links usually remove more scope, because customers key their own details.
Who signs the attestation?
An officer of your business signs it.
Related guides
Choose the right PCI compliance virtual terminal setup
Tell us how staff take payments. We reply in writing, usually within one business day, with an honest view of the options.
Ask us anything