A card number read to you over the phone is a card-not-present transaction. If it turns out to be stolen, the chargeback lands on you, not on the bank, and you have already given away the food. That single fact is why the phone deserves rules that your counter does not, and why "we've never had a problem" is a statement about luck rather than about controls.
The good news is that the operations aimed at restaurants are not sophisticated. They follow a small number of recognizable shapes, they aim at the same targets, and most of them fall apart against a callback.
The shape of the standard attempt
It is a large order. Four hundred dollars of catering trays, or two hundred in wings, called in for pickup or delivery in an hour or two. Small orders are not worth the trouble, so size is almost always the first signal.
The caller is friendly, hurried, and has a story about why the timing is tight. An office lunch that got moved up. A team that just landed. The urgency is functional: it exists to compress the window in which anyone stops and checks something.
The card is read aloud, sometimes several cards if the first declines. A caller who works through three cards in one conversation is telling you something. Legitimate customers occasionally have one card decline. They do not usually have a stack.
And then some detail creates distance between the card and the food. Delivery to an address that is not the billing address. A request to leave it outside. Someone else picking up. A callback number that is a mobile the caller answers rather than the office they claim to be at.
The specific things worth stopping for
- A first-time caller placing an order well above your typical ticket, paying by card over the phone, for same-day fulfillment
- A billing zip code that does not match, or a caller who does not know the billing address on the card they are holding
- Delivery to a location the caller cannot confirm details about, or a request to hand the order to someone waiting outside rather than at a door
- Multiple card attempts in one call, or an offer to split the total across cards for no stated reason
- Pressure applied when anyone suggests calling back, which is the single most reliable signal on the list
None of these is proof on its own. Two of them together on a four-hundred-dollar ticket is a callback, every time.
The variants that skip the food entirely
A second family of calls is not trying to buy anything. Someone claims to be from your payment processor, your delivery platform, or your own corporate office, and asks a staff member for a merchant portal login, a card number on file, or a verification code that just arrived by text.
These work because they arrive mid-rush and sound official. The defense is a sentence every employee should know: nobody legitimate ever asks you to read back a code from your phone. Not the processor, not the platform, not the POS vendor. If the call goes there, hang up and call back on the number in your own dashboard.
The gift card version is the same trick wearing a different hat. A caller claiming to be the owner asks a manager to buy gift cards, or to activate cards and read the numbers, always urgently and always with a reason they cannot be reached directly. Gift cards are the payout because they move instantly and cannot be recalled, which is also why gift card sales by phone need their own rules.
What actually reduces the loss
Verification by callback is the strongest single control and it is free. On a large first-time card order, take the order, tell the caller you will confirm in a few minutes, then call the number on file for the card or the business rather than the number they gave you. Fraudulent orders die at this step, usually by the caller simply not answering.
Address verification catches the subset where a number was stolen without the cardholder's details. It costs five seconds and should be routine on any card taken by phone.
A size threshold is the other half. Pick a dollar figure, above which a card order requires either a callback or in-person payment, and write it down like any other policy number. Most operators can set this at two or three times their average phone ticket without touching legitimate business at all. For genuine catering, the qualification conversation covers this anyway, which is part of why large catering orders route differently from ordinary phone orders.
Not storing card numbers is the control that limits the damage of everything else. If nobody in the building ever writes a number down or types it into a note, the exposure ends with the transaction. What that requires operationally is covered in collecting payment over the phone safely and the handling requirements in PCI compliance for restaurant phone payments.
Where an automated agent changes the picture
The honest version is that it depends entirely on configuration, and the effect runs in both directions.
An agent follows the size threshold every time, including at 8:15 on a Friday when a manager would have waved it through to get off the phone. It does not respond to urgency, flattery, or a caller who says they know the owner. Social engineering is aimed at humans and it does not land. That is a real advantage and it is the part vendors undersell.
The other direction is that an agent taking payment with no rules configured will process anything it is handed, quickly and repeatedly, which makes a badly configured system a faster target than a slow one. Ask a vendor what happens on a four-hundred-dollar first-time card order. If the answer is that it processes normally, the threshold has not been built and you should ask for it before launch. Where the agent hands a suspicious order to a person is the same escalation plumbing as everything else, described in human handoff and failover.
Also worth asking: is the card number ever spoken back, recorded, or written into a transcript. Tokenized capture avoids that entirely, and the difference is explained in phone payment tokenization.
What this costs if you get it wrong
Run the arithmetic once, with your own numbers. A four-hundred-dollar fraudulent catering order costs you roughly a third of that in food, an hour or two of kitchen labor during a service you were already staffing, the processing fee, and a chargeback fee from your processor. Call it two hundred out the door on a ticket that was never real.
Against that, a callback policy might cost you the occasional legitimate customer who found the check annoying. Set your threshold, write the callback sentence your staff will actually say, and tell them plainly that nobody will ever be criticized for calling a large order back. The chargeback history that follows from all of this, including how the disputes themselves play out, is in call fraud and chargebacks.