Payment links have become a standard way to take card payments outside a website checkout. A hotel sends a deposit link after a phone booking, a clinic emails an invoice with a ‘pay now’ button, a sales team sends a link in a chat. The customer opens the link, enters their card details on a hosted payment page and pays.<\/p>\n
Because the conversation that led to the payment often happened by phone or email, link payments are sometimes treated like mail order or telephone order (MOTO) payments. For authentication purposes they are not. The customer enters their own card details online, which makes it an ecommerce payment, and EMV 3D Secure (EMV 3DS) applies in the same way as at any checkout.<\/p>\n
In a MOTO payment, the customer gives card details to the merchant by phone or post, and the merchant enters them. In a link payment, the merchant only supplies the link; the customer completes the payment on a web page. That is a remote electronic payment initiated by the customer.<\/p>\n
The distinction matters most in the EEA and UK. The European Banking Authority has stated that remote non-electronic payments initiated by mail or telephone order can be considered out of scope of strong customer authentication (SCA), while card payments initiated by the payer through the payee are electronic payments within its scope (EBA Q&A 2019_4788<\/a>). A link payment completed online by the customer falls on the electronic side of that line, so SCA rules apply and EMV 3DS is the normal way to meet them. Outside those markets there may be no mandate, but the liability position still depends on whether the payment was authenticated.<\/p>\n Our MOTO guide<\/a> covers payments where the merchant does take card details by phone or post.<\/p>\nWhy payment links attract fraud<\/h2>\n
\n
Design choices that help link payments authenticate well<\/h2>\n