Taking card payments for taxi bookings safely: links, phones and deposits

A passenger books an airport run by phone on Monday and wants to pay by card before Saturday. The question for the office is how to take that money without a controller reading card numbers off a notepad. This guide compares the ways to take card payment for a taxi booking, explains what the card industry's security standard expects, and covers holds, surcharges, account customers and refunds.

What are the ways to take card payment for a taxi booking?

There are five, and the big difference between them is whether card numbers ever pass through your office.

A taxi card payment link is the simplest of these for a booking taken by phone. The passenger gets the price and the link in the same message as the confirmation, pays on their own phone, and your office never hears a card number.

Why is a payment link safer than taking cards over the phone?

A payment link keeps card data out of your office altogether. Card details over the phone do the opposite, and the PCI Security Standards Council's guidance on telephone payments sets out why that's risky.

Its information supplement, Protecting Telephone-Based Payment Card Data, says all personnel with access to payment card data are in scope of PCI DSS and should be trained and screened. It treats the card verification code, the three or four digits printed on the card, as sensitive authentication data, and it says that data must not be stored after authorisation, even if it's encrypted. If a call recording captures the code, the business must make it unrecoverable once the payment is authorised.

For a small office with no special equipment, the supplement goes as far as suggesting firms restrict access to notebooks and pens, phones that can take notes, and anything that can record a voice or take a picture, wherever card numbers are spoken.

So a controller who writes a card number on a pad "just until the system's back up" is the risk the standard is written to stop. The same supplement says a firm that takes very few phone payments, and already has a secure alternative such as a PCI DSS compliant online channel, can avoid the risk altogether by not taking card details on the phone. For a taxi office, the payment link is that alternative.

What does PCI DSS mean for a small taxi firm?

PCI DSS is the card industry's data security standard, set by the PCI Security Standards Council. If you accept cards, your card provider expects you to meet it, and one way businesses show that is a self-assessment questionnaire, or SAQ.

The questionnaire you fill in depends on how you take cards. The council says SAQ A includes only the requirements that apply to merchants whose account data functions are completely outsourced to PCI DSS validated and compliant third parties, keeping at most paper reports or receipts. A firm that only uses payment links and the provider's own payment pages is aiming for that position.

Two practical points follow:

1. Pick a provider that hosts the card form. If your booking page shows its own card fields, your website comes into the picture. Since 31 March 2025, merchants using SAQ A for e-commerce must also confirm their site isn't susceptible to attacks from scripts that could affect their e-commerce systems. Ask your web designer and provider how the payment page is loaded.
2. Write down how your office handles cards. Who can send a payment link, what staff say when a passenger reads out a card number anyway, and that nobody writes card details down. Ask your card provider which questionnaire applies to you.

Can you take a deposit or hold money on a card?

Yes. Payment providers such as Stripe let you place a hold, which reserves the money on the passenger's card now and takes it later. The hold doesn't last long, though.

Stripe's documentation says an authorisation for an online card payment is usually valid for 7 days. For a Visa payment the business starts without the cardholder present, it's 5 days. If you don't capture the money before the hold expires, it's released. Stripe also notes that some card statements don't show the difference between a hold and a payment, which can confuse passengers.

That shapes how you use holds:

• Bookings in the next few days: a hold works. Capture the fare after the journey, and if you capture less than you held, Stripe says the rest is released automatically.
• Pre-books weeks ahead: a hold will expire first. Take payment when the passenger books, or take a deposit then and send a payment link for the rest closer to the day.
• Waiting time and extras: decide in advance whether you'll hold a little more than the fare, and say so in the confirmation.

Write your deposit and cancellation rules into your terms and show them before the passenger pays. Our guide to reducing no-shows and late cancellations covers setting them.

Can you charge a fee for paying by card?

Not on personal cards. Regulation 6A of the Consumer Rights (Payment Surcharges) Regulations 2012, inserted by the Payment Services Regulations 2017 from 13 January 2018, says a business must not charge a fee for payment by card, except commercial cards. For any payment method you do accept, it also bans any fee that exceeds the costs you bear for it.

So a card surcharge on a passenger's own debit or credit card is out. Build what cards cost you into your fares instead. If you run hackney carriages, section 65 of the Local Government (Miscellaneous Provisions) Act 1976 lets councils outside London fix hackney carriage fares, so check your council's tariff before you change anything.

How should account customers pay?

Business customers can pay by invoice on agreed terms, which keeps card details out of it entirely. Agree the payment date in writing when you open the account.

If you don't agree one, GOV.UK's guidance on late commercial payments says the payment is late 30 days after the customer gets the invoice or the service is delivered, whichever is later. You can then charge statutory interest at 8% plus the Bank of England base rate, and a fixed sum towards recovering the debt:

Some account customers would rather pay by card. Let them save a card through your payment provider's own page, never by emailing card numbers to the office. Our guide to business accounts in your booking system covers setting accounts up.

How do you handle refunds and cancellations?

Refund through your payment provider, back to the card that paid, and never ask a passenger to read out card details for a refund. Note the refund against the booking so the record matches.

Taxi bookings don't carry the 14-day cooling-off period that applies to many online purchases. Regulation 27(2)(c) of the Consumer Contracts Regulations 2013 takes contracts for passenger transport services out of those cancellation rights, so your own terms decide when a passenger gets a refund. Put them in the booking confirmation by text and email as well as on your website.

Dispatch AI is booking and dispatch software for taxi and private hire firms, and its phone agent never takes card details over the phone. Customers pay by card through a secure payment link sent to them by email.