Hotel mail order forms: how to take card details and how not to

A mail order form is a signed instruction that lets a hotel charge a card the guest is not present with, and only your bank agreement can allow that. The safer default is a payment link, where the guest types the card on the bank's page and the hotel never sees the number. Never record the security code.

At 22:40 the reservations inbox receives a photo of a bank card, front and back, with the guest's name written on a piece of paper beside it and the words "please charge the deposit". The booking is real, the guest is waiting, and the hotel now holds something it was never designed to hold. This guide is the procedure for that moment and for everything around it: where card numbers end up in a hotel, when a hotel credit card authorization form is allowed at all, what it must contain, what to do the day a number arrives by email, who may see it, how long it stays, how it is destroyed, and what proof helps if the charge is disputed later.

Where do card numbers actually end up in a hotel?#

In more places than the reservations team expects, and almost none of them were built to hold card data. The first job is to find them, because a rule you cannot enforce is not a rule.

The shared reservations inbox is the most common one. One address, several staff, automatic forwarding rules nobody remembers writing, and a synced copy on every phone that opened it. Chat apps on personal phones are worse: a guest's WhatsApp message with a card photo lands in a personal backup the hotel does not control and cannot clean up. Paper still exists too, signed forms in a drawer at the front desk, sometimes scanned later into a folder nobody remembers.

Screenshots and spreadsheets are the quiet ones: a deposits sheet with card numbers typed into a column, or a photo saved to a desktop "just for today". The OTA extranet holds virtual cards issued by an agency, which are still card data with their own rules about when they may be charged. The printer and the scanner each keep memory: a form printed and left in the tray, a scan that stays in the scanner's own storage. Even the notes field of a property management system gets used, because it accepts anything.

The practical step is a walk-through. Take one real booking from first enquiry to check-out and write down every place the number appears. That list is your starting point, not a general policy document. For how agency-issued cards differ from the guest's own card, see OTA payment terms explained: hotel collect, OTA collect and virtual cards.

What is a mail order form, and does your bank allow it?#

A mail order form is the hotel's record that the cardholder authorized a charge on a card that was not present at the desk. The form does not grant permission to charge anyone: your agreement with the acquiring bank does.

Mail order, also called MOTO (mail order / telephone order), means the hotel types card details the guest gave remotely into the bank's payment screen or the hotel system's payment screen. It is a card-not-present charge: no card in hand, no chip, no PIN. When a guest later says "I did not authorize this", the money is usually recovered from the hotel first and argued about afterwards.

The bank agreement decides whether you may take mail order at all, which fields you must keep, whether the signed form must be sent to the bank, and by when. The extra confirmation step the bank runs in a browser, 3D Secure, normally does not apply to a card the hotel types in, so the protection it gives on your own website is not there. Ask your bank whether it prefers its payment link or your virtual POS for this case. Ask the question directly: is mail order allowed for us, and under which conditions.

Get the answer in writing and check it with your accountant. Nothing in this article makes a form legally valid, and bank rules differ from bank to bank and change. For the vocabulary around this, see hotel payment technology terms: virtual POS, 3D Secure, tokens and chargebacks.

Which should you use: a form, a payment link or a virtual POS?#

Use the payment link first, the virtual POS for your own website, and the form only where the bank agreement allows it and the guest genuinely cannot complete a link.

A payment link means the bank or payment provider hosts the page, the guest types the card, and the hotel receives a result rather than a number. A virtual POS is the checkout on the hotel's own website: same principle, the card is entered by the guest, and the bank's confirmation step can apply. Mail order means the hotel types the card. It is the fastest option on the telephone and the one that puts the number in your hands.

The decision rule is simple. Can the guest open a link within the time you need the money? If yes, send the link. If no, ask whether mail order is allowed, and whether the amount and the guest's identity are verified well enough for the risk. If not, offer a bank transfer or payment on arrival.

Each method has trade-offs. A link needs a channel the guest reads and a guest who acts, and links expire. A form needs storage, access control, a retention period and a destruction step, which is real work every month. Whatever you choose, the number of people who can see a full card number should be as close to zero as the process allows. That target does not change with the method. For how deposits and prepayments fit into the booking, see direct booking payments: prepayment, deposits and installments.

What must a mail order form contain, field by field?#

Enough to prove who authorized what, on which card, for which reservation, for how much and when, and nothing beyond that.

The cardholder section needs the full name as printed on the card, and a signature. If the person staying is not the cardholder, say so on the form and record the relationship. The card section needs the card type and the last four digits. If your bank requires the full number on the form, then the form is card data and must be stored, restricted and destroyed like card data, not filed with ordinary paperwork.

The amount and currency must be stated, and what the charge is for: a deposit, a prepayment, a full stay, or a no-show charge. The reservation reference ties it to arrival and departure dates, room type, number of nights, and the guest name if it differs from the cardholder. A plain statement of consent covers what the guest agrees to be charged, under which cancellation conditions, with a line confirming they are the cardholder. Record the date and time the authorization was given, and the channel it came through: email, telephone, or an agency.

A labelled sample helps staff. For example, a filled form for a three-night stay with a one-night deposit, marked clearly as an illustration rather than a real booking, pinned next to the reservations desk as the model to copy.

A card number just arrived by email. What do you do that day?#

Contain it, stop it spreading, move the guest to a payment link, and write down what happened. The same five steps work for a chat message, a photograph or a fax.

Do not forward the message, do not reply quoting it, and do not download the attachment to a shared drive. Every copy you make is a new place to clean up. Move the booking forward in a restricted place: the reservation record, with the number redacted, so the guest is still served and the number is not carried along.

Send the guest a payment link with one plain sentence: for your security we do not keep card details, please use this link. If the guest objects, move to the fallback options below. Record the event in a small log: date, who saw it, which mailbox or phone, what was done. One line per event is enough, and the log is what shows a pattern later.

Remove the message and any attachment from the mailbox and from the copies you control, on a schedule your adviser confirms, and do the same on the phone it reached. If the guest refuses the link, offer a bank transfer or payment on arrival rather than accepting the number. A booking lost is cheaper than a card number kept badly. Tell the guest once, calmly, that they may wish to speak to their bank. Whether to cancel the card is their decision, not the hotel's.

Who may see card data, how long does it stay, and how is it destroyed?#

The fewest named people, the shortest period your bank, your accountant and the law allow, and a destruction step you can prove afterwards.

Name people, not roles. A list of two or three names, kept current, with access removed on the day someone leaves or changes shift pattern. Store card data apart from everything else: a locked cabinet for paper, a restricted folder for files, never the general reservations inbox or the shared drive.

There is no single retention period that fits every hotel. Your bank agreement, tax record rules and personal data rules each set something, and they differ; under the personal data law (KVKK, kişisel verilerin korunması kanunu) retention must also be justified and limited. Ask your accountant and your adviser, write the answer down, and follow it. Destroy on a schedule: cross-cut shredding for paper, secure deletion for files, and a one-line destruction log with date, what was destroyed and who did it.

The security code is never stored at all, even briefly. The card schemes' security rules and your bank's agreement treat keeping it after authorization as a serious failure. Test once a year: pick one booking and try to find every copy of its card number. What you cannot find is either destroyed or invisible, and you need to know which.

What proof helps if the charge is disputed later?#

The evidence that helps is a chain showing the cardholder authorized this amount for this stay, and that the stay actually happened.

Keep the authorization evidence with the reservation, not in a separate folder: the signed form or the payment link result, and the correspondence where the guest asked for the charge. Show the stay: registration details, the check-in record, the guest bill with the guest's signature, and the departure record.

A payment link result carries the bank's own confirmation, which is stronger than a form the hotel filled in and the guest signed. A form alone is weak if the guest says they never authorized it and never stayed. The stay record is what closes that gap.

The list of accepted evidence and the deadlines for answering are set by the card schemes and your bank, and they change. Ask for the current list before you need it. File everything so it can be retrieved by reservation number, not by date. A dispute answered in a day looks very different from one answered in a week. For the full procedure, see card chargebacks at hotels: answering a dispute with the right evidence.

What to do next#

Write the one-page rule for the reservations office today: the payment link is the default; a card number that arrives by email is contained the same day; the form is used only where the bank agreement allows it, and is stored and destroyed on a written schedule; every booking keeps its authorization evidence beside it. Then send your bank one written question, whether mail order is allowed for your hotel and on which conditions, because that answer decides which of these procedures you are actually allowed to run.