EMV 3DS 3RI and Active Call Detection (ACD): A Technological Paradox That Could Jeopardise the Future of Secure Voice Commerce
Pay by Call, S.L. | Technology & Strategic Analysis | November 2026
Since 2018, the payments industry has had access to a standardised mechanism for authenticating telephone orders through EMV 3DS 3RI (Telephone Order = 09). However, certain implementations of Active Call Detection (ACD), designed to prevent telephone fraud, may interfere with legitimate authentication processes. Resolving this potential incompatibility could improve the security of existing telephone payments while preparing the ecosystem for Voice Commerce and Agentic Commerce.
1. The Paradox: Can a Bank Prevent an Authenticated Payment Simply Because Its Customer Is on a Phone Call?
Consider an everyday situation.
A customer wants to amend an existing airline reservation while speaking to a member of the airline’s customer service team. The agent informs the customer that the amendment involves a fare difference. The transaction is entirely legitimate, the customer has chosen to make the call, and both parties want to complete the operation securely without disrupting the conversation.
A customer calls an airline to modify a booking. The agent explains that an additional fare must be paid. The airline uses a PCI DSS-certified platform to protect cardholder data and request EMV 3-D Secure authentication from the issuing bank.
The customer agrees to pay. The system initiates an EMV 3DS 3RI authentication request using Telephone Order = 09 (TO=09), indicating that the request relates to a telephone order.
The issuer’s Access Control Server (ACS) receives the request and decides that the customer should authenticate through the bank’s mobile application. So far, everything is working as intended.
Then a problem arises.
The issuing bank has correctly identified an authentication request and is ready to verify that the person making the payment is the genuine cardholder. At this point, however, the mechanism selected to verify the customer may come into conflict with an independent protection implemented by the mobile banking application.
The banking application detects an active telephone call. If the bank has configured Active Call Detection to restrict certain sensitive operations whenever a call is active, the authentication process may be blocked.
The customer cannot complete authentication, and the merchant loses the opportunity to process an authenticated payment.
A technology designed to combat telephone fraud could prevent another technology, specifically designed to authenticate payments and reduce fraud, from doing its job.
This is the paradox we believe the industry should address.
In this scenario, neither technology is inherently defective. EMV 3DS is being used to enable issuer authentication, while Active Call Detection is providing a signal that can help protect customers against social engineering. The difficulty arises if the presence of a telephone call is treated as a sufficient reason to prevent the very authentication designed to protect the payment. We are not questioning the value of ACD or suggesting that banks disable protections against vishing.
Instead, we are asking: How can two technologies designed to protect the same customer complement each other rather than cancel each other out?
The consequences could extend far beyond one unsuccessful transaction. They could affect the transformation of a substantial existing market and become a barrier to Secure Voice Commerce.
2. Today’s MOTO Market: Billions of Transactions That Need to Evolve Towards Authenticated Payments
Before discussing the future, we should understand the market that already exists.
The scale of current telephone-related payments matters because security decisions made today are not merely preparation for hypothetical future applications. They affect a payment channel that is already used across numerous sectors and countries, including organisations that rely heavily on assisted customer service and contact-centre operations.
MOTO (Mail Order / Telephone Order) payments remain part of everyday operations for airlines, insurance companies, hotels, utilities, public administrations, financial services providers and contact centres. Available statistics show that this is far from an economically insignificant channel.
European Union: 648.8 Million Transactions and €57.576 Billion
According to Pay by Call’s analysis of official European Central Bank statistics, the EU recorded the following figures for 2025:
| Indicator | EU, 2025 |
|---|---|
| MOTO transactions | 648.8 million |
| GMV MOTO transaction value | €57.6 billion |
| Average transaction value | €88.74 |
| Share of CNP transaction volume | 3.16% |
| Share of CNP transaction value | 4.81% |
MOTO accounts for a greater proportion of card-not-present transaction value than of transaction volume. This is an important characteristic: even when telephone and mail-order payments represent a relatively limited share of the number of remote card transactions, their share of the money changing hands can be materially higher. The economic importance of this payment category therefore cannot be understood by looking only at transaction counts.
In Spain, the market recorded 89.58 million MOTO transactions worth €8.363 billion, with an average transaction value of €93.36.
These figures demonstrate the significance of an existing channel with considerable room to strengthen authentication.
United States: 3.0 Billion MOTO Transactions as Reported by the Federal Reserve
The Federal Reserve Payments Study (NPIPS, 2022 data released in November 2024) explicitly identifies Mail-order/telephone-order within remote payments made with general-purpose cards. Table 1 reports the following figures, using the precision published by the Federal Reserve:
| Indicator | US, 2022 |
|---|---|
| MOTO transactions | 3.0 billion |
| GMV MOTO transaction value | $870 billion |
| Published average MOTO transaction value | $293 |
| Estimated share of remote card transaction volume | 5.4% |
| Estimated share of remote card transaction value | 16.7% |
| Change in MOTO transaction count, 2021–2022 | +5.0% |
| Change in MOTO transaction value, 2021–2022 | +16.4% |
The $293 average is published directly by the Federal Reserve. It should not be replaced with $290, which results from dividing rounded aggregate figures. The 3.0 billion transactions and $870 billion in value are also official as published; they are not raw, transaction-level counts or dollar-exact values. The 5.4% and 16.7% shares are calculated from the published MOTO and total remote-payment aggregates and are subject to rounding.
The difference compared with the European Union is significant.
In the United States, MOTO represents a substantial proportion of the economic value of remote card payments.
Its average transaction value is also notably high.
This reinforces the importance of implementing mechanisms that allow telephone transactions to be properly authenticated.
United Kingdom, Brazil and Mexico: An Even Larger International Opportunity
To approximate the size of other markets, Pay by Call developed an exploratory exercise applying MOTO/CNP ratios observed in the EU and US to public remote-payment statistics.
| Market | Estimated MOTO Transactions | Estimated GMV Transaction Value |
|---|---|---|
| United Kingdom | 174.5 million | £38.4 billion |
| Brazil | 220 million | BRL 118.1 billion |
| Mexico | 72.6 million | MXN 70.3 billion |
The purpose of this exercise is to illustrate the international dimension that may exist beyond the two markets for which the analysis reports separately identified MOTO statistics.
These are Pay by Call estimates, not official MOTO statistics. They illustrate potential market size, with especially high uncertainty regarding the estimated number of transactions in Brazil. Underlying statistical categories are not perfectly comparable, so these extrapolations should be treated as analytical scenarios rather than definitive market measurements.
However, the core argument does not depend on these estimates.
The European Union and the United States alone recorded more than 3.6 billion MOTO transactions in their respective reference years. Adding the published figures gives an indicative 3.6488 billion, but this is neither a single-year global total nor an unrounded exact count.
We are not discussing an imaginary future market.
It is a channel with established use cases, existing merchants, customers and transaction volumes. Strengthening authentication in that channel can produce practical benefits without requiring businesses to wait for new voice-enabled purchasing habits to emerge. The payments industry has a standardised foundation that can contribute to that transformation. We are discussing an established international payment channel that could benefit from stronger authentication.
3. EMV 3DS 3RI TO=09: Authenticating Telephone Payments Without Necessarily Sending Payment Links
On 14 December 2018, EMVCo published version 2.2.0 of its EMV 3-D Secure standard, including capabilities relevant to transactions initiated outside conventional e-commerce checkout flows. This matters because a telephone order does not necessarily follow the familiar sequence in which a customer opens a website, places goods in a basket and completes authentication in a browser. Authentication arrangements must be capable of accommodating different purchase journeys when the standard expressly provides for them.
Two capabilities are particularly important:
3DS Requestor-Initiated (3RI): certain authentication requests can be initiated by the merchant or its technology provider, within the use cases defined by the standard.
Decoupled Authentication: cardholder authentication can take place through a process separate from the primary purchasing interaction.
The protocol explicitly includes 3RI Indicator = 09, Telephone Order.
Together, these capabilities provide a way to request issuer authentication while the consumer continues speaking to a commercial agent. The issuer can assess the request in the context of the specified use case and, where the necessary infrastructure and authentication method are supported, verify the customer using a process that is separate from the original commercial interaction. Where the issuer’s infrastructure supports it, authentication may be completed through a separate mechanism, such as the banking application.
The consumer does not necessarily need a payment link that redirects them to another commercial environment. The objective is to incorporate bank authentication into the telephone payment experience.
Why Does This Matter?
Historically, telephone merchants have been able to introduce systems that prevent customer service agents and contact-centre infrastructure from unnecessarily accessing sensitive cardholder information. Such protection is essential, but it addresses one dimension of payment security.
PCI DSS-compliant systems can protect cardholder data during telephone payments. But protecting card data is not the same as authenticating the cardholder.
PCI DSS and EMV 3DS serve different purposes: the former protects payment data; the latter provides mechanisms for issuer participation in authentication.
Combining both capabilities allows traditional MOTO to evolve towards ATO (Authenticated Telephone Order), as we call it at Pay by Call. The objective is not to replace the telephone conversation with a different selling channel, but to introduce appropriate bank authentication into the transaction while preserving the continuity of the commercial conversation.
It is striking that this technical possibility has existed since December 2018 without being widely adopted for real-time telephone payment authentication.
We do not need to invent a new international protocol from scratch. We need to accelerate adoption and interoperability.
4. Active Call Detection: An Essential Technology That Must Consider Context
Telephone fraud involving social engineering is a major threat to financial institutions. These attacks often exploit the victim’s trust rather than a technical weakness in the bank’s infrastructure. Fraudsters can attempt to impersonate a bank, create a false sense of urgency or persuade the customer to approve a transaction that the customer would otherwise reject. Against that background, banks have good reasons to consider whether a sensitive banking action is taking place while someone may be influencing the customer over the telephone. In many cases, criminals do not directly breach banking infrastructure; they persuade victims to carry out fraudulent transactions themselves.
Such vishing attacks have encouraged banks to introduce new protections into their mobile applications, including Active Call Detection (ACD).
ACD identifies whether the user is engaged in an active telephone call during a sensitive operation. That information can contribute to risk scoring, customer warnings or additional controls.
Its value is clear. But detecting a call is not the same as proving fraud. The same technical observation—that a telephone call is in progress—can arise in circumstances that have entirely different levels of risk. A suspicious unsolicited call and a customer-initiated call to a trusted airline, insurance provider or public administration should not necessarily lead to the same response.
Someone may be speaking to a scammer. Equally, they may be talking to an insurer, airline, hotel or public service provider to conduct a legitimate commercial transaction. In the latter situation, issuer authentication may be exactly what makes the transaction safer.
When One Protection Mechanism Can Block Another
Some mobile-security implementations can restrict operations during an active call. Industry experience has also raised questions about call-related restrictions affecting some bank authentication processes.
Their actual scope must be investigated by issuer, device, application and authentication method. An operating-system feature, an individual banking app, an ACS decision and a particular authentication mechanism may each influence the outcome. Consequently, it is important to understand the actual conditions under which restrictions occur before drawing conclusions or proposing industry-wide changes. These behaviours cannot be generalised across all banks, but they should not be ignored.
An active call should not automatically be equated with a fraudulent transaction. Authentication can be legitimate, necessary and beneficial to the customer.
5. Pay by Link Can Face the Same Conflict: A Challenge for the Entire Telephone Payment Channel
It might appear that avoiding 3RI and sending a conventional payment link would solve the problem. A payment link can move the commercial transaction into a browser or another digital environment, but it does not necessarily end the original telephone call. The cardholder may still be speaking to the agent when the issuer decides that additional authentication is required. Not necessarily.
A customer on the phone with a commercial agent might open a Pay by Link and begin an e-commerce payment. If the issuer requires authentication via its banking app while the call remains active, a restrictive ACD policy could interfere with that process too.
The potential conflict is not exclusive to EMV 3DS 3RI or to one payment technology provider. It can also affect conventional authenticated e-commerce transactions conducted during telephone conversations.
The real question is how banking fraud controls can remain compatible with legitimate voice-based commercial transactions.
A customer should not routinely have to end a legitimate conversation to authenticate a payment, although particular risk circumstances may justify asking a customer to terminate a suspicious call.
Security should respond to context rather than treat every telephone call as equivalent.
6. France: An Industry Initiative to Transform Telephone Payment Authentication
The French approach is relevant because it treats telephone-payment security as an industry issue rather than as the responsibility of a single merchant or technology provider. The objective is not simply to introduce a new customer interface, but to improve how a long-established remote-payment channel is authenticated within the wider card-payments ecosystem.
France is driving an important evolution in remote-payment security.
The Observatoire de la Sécurité des Moyens de Paiement (OSMP), associated with Banque de France, has published recommendations on strengthening remote card payments outside conventional 3-D Secure mechanisms.
Recommendation No. 5 encourages merchants and payment service providers to experiment with authentication solutions adapted to MOTO payments and calls for work on strong authentication solutions for telephone payments during 2026.
The Role of EMV 3DS 3RI
For this type of initiative to succeed, it is necessary to look at the complete authentication journey, including both the systems that initiate the 3DS request and the tools that the cardholder actually uses to respond. Technical compliance in one part of the process is insufficient if a separate security mechanism prevents the process from being completed.
Pay by Call is contributing to this evolution through technology based on EMV 3DS 3RI Telephone Order = 09. Our PBC 3DS technology (patent pending) orchestrates cardholder authentication during the call.
Widespread implementation requires cooperation between issuers, ACS providers, PSPs, card schemes and technology providers. We believe the discussion should also include mobile-security and ACD vendors.
It would be of little use to prepare 3DS infrastructure for telephone authentication if certain mobile-security configurations prevented cardholders from completing the process. Interoperability testing should therefore be built into deployment programmes from the outset.
This is about combining protections, not weakening them.
7. Liability Shift: A Financial Incentive to Adopt Authenticated Telephone Payments
There is an additional argument that should be central to the conversation with merchants and payment service providers: the financial allocation of fraud risk. Improved authentication can help reduce the probability of certain fraudulent transactions, but its significance is not limited to preventing individual incidents. Under specified conditions, successful authentication can also affect which participant bears certain financial losses resulting from fraud.
EMV 3DS can do more than contribute to lower fraud. It can also affect who bears financial responsibility for certain fraudulent transactions.
Traditional MOTO transactions can expose merchants to fraud-related chargebacks, depending on the circumstances and the applicable card scheme rules.
EMV 3DS authentication creates a further opportunity: fraud liability shift.
What Does Liability Shift Mean for Merchants?
For a business processing telephone payments, fraud chargebacks are not simply a technical compliance concern. They may affect profitability, operational overheads and the predictability of payment costs. The potential to qualify for appropriate card-scheme liability protection can therefore provide a concrete commercial reason to invest in authentication, particularly in sectors where transactions can carry relatively high values.
When a transaction satisfies the relevant card scheme’s eligibility criteria, responsibility for certain fraud-related chargebacks may transfer from the merchant to the issuer.
For sectors with relatively high average telephone payment values—such as travel, insurance and hospitality—the economic benefit could be significant.
Can EMV 3DS 3RI TO=09 Qualify?
The answer must distinguish a technically valid authentication request from an authentication outcome that qualifies for protection under the rules of the relevant scheme. These are not necessarily equivalent. Card scheme eligibility, successful completion of the flow and correct downstream treatment of the authentication evidence all matter when assessing whether fraud liability shift is available.
Certain Telephone Order transactions authenticated through EMV 3DS 3RI may qualify for liability shift when they meet the applicable card scheme and authentication-programme requirements. This is not a universal guarantee.
Among other conditions, eligibility depends on:
- The transaction type and applicable scheme rules.
- Correct completion of authentication.
- The final result supplied by the ACS and relevant systems.
- The required authentication indicators and evidence.
- Correct transmission by the PSP and acquirer in the authorisation message.
Where decoupled authentication is used, the initial status indicating that a decoupled process will take place is not itself completed authentication. The final outcome must be obtained and correctly processed. Frictionless authentication likewise requires a valid result and compliance with applicable rules.
Completed EMV 3DS authentication + correctly transmitted evidence + compliance with scheme rules = potential liability shift for eligible transactions.
The Economic Paradox of ACD
Consider the commercial consequences if a merchant has invested in protecting card data and in enabling issuer authentication, specifically to make telephone payments safer. If an indiscriminate active-call restriction prevents the customer from authenticating, the merchant may lose both the operational benefits of an authenticated payment and the opportunity to receive card-scheme liability protection where it would otherwise have been available.
Now consider a merchant equipped to authenticate telephone payments and, where eligible, reduce exposure to certain fraud chargebacks. If the issuer systematically restricts authentication because the customer is still speaking on the phone, a protective measure may unintentionally prevent access to an additional security mechanism.
ACD–3RI interoperability therefore has direct potential implications for merchant costs and the allocation of fraud risk throughout the payments ecosystem.
8. The Solution: Context-Aware Fraud Prevention and Interoperable Technologies
The issue should not be framed as a choice between protecting customers from vishing and permitting telephone payments. Both objectives are legitimate. The question is whether the available security controls can be combined so that the presence of a call informs a more complete risk assessment rather than becoming, on its own, a reason to stop the transaction.
The answer is not to eliminate ACD, but to use it more intelligently.
An active call is a potentially useful risk signal. It should be considered alongside transaction context, device intelligence, behavioural information and anomaly detection.
Providers such as Outseer, Wultra, LexisNexis Risk Solutions, BioCatch and Incognia develop various contextual fraud-prevention capabilities, although their products and technical architectures differ.
A Complementary Security Architecture
A practical approach would involve assigning each technology its proper role. ACD can report that a call exists; EMV 3DS can convey the context of the authentication request; device and behavioural signals can help identify suspicious activity; and the issuer’s risk systems can determine an appropriate response. Such a model would preserve the value of call detection without assuming that all calls carry identical risk.
One possible approach could combine:
Active Call Detection: supplies a signal that a telephone call is active.
EMV 3DS 3RI: provides context about a request identified as a Telephone Order, allowing the ACS to evaluate it.
Device and behavioural intelligence: supplies additional signals of possible manipulation or anomalous activity.
Contextual risk assessment: supports controls proportionate to the nature and circumstances of the operation.
TO=09 should not be treated as automatic proof of legitimacy, just as an active telephone call should not be treated as automatic evidence of fraud.
Transaction Risk Analysis (TRA) technologies and other risk-assessment approaches may help. These general analytical capabilities should not be confused with the specific regulatory TRA exemptions provided for under PSD2.
The goal is not to bypass authentication. It is to make secure authentication possible for legitimate transactions while maintaining enhanced controls where the risk justifies them.
This requires collaboration between ACD vendors, ACS providers, issuers, PSPs and card schemes, together with practical testing of what information can be exchanged securely.
9. Secure Voice Commerce: Transforming an Existing Market and Preparing for the Next Stage
Voice assistants and conversational commerce can make Voice Commerce sound like a market that will only emerge in the future. Yet telephone-based commerce already represents a substantial volume of payments.
The MOTO statistics presented above document 648.8 million transactions worth €57.6 billion in the European Union in 2025, and 3.0 billion transactions worth $870 billion, with a published average of $293, in the United States in 2022.
These are different markets and different reporting years. Their figures should not be combined to calculate a single global annual total. They do, however, demonstrate the scale of existing telephone payment activity.
The immediate opportunity is to strengthen the security and authentication of transactions already taking place—not to wait for an entirely new market to emerge.
It would be methodologically inappropriate to compare these MOTO figures, which represent gross payment value (GMV) , directly with certain commercial forecasts labelled Voice Commerce. Such studies may use different market boundaries and revenue metrics rather than gross transaction value.
Conversational AI Will Transform Commercial Interactions
Artificial intelligence is enabling agents to conduct natural conversations, understand requests, retrieve information and manage commercial processes.
An AI assistant can help book a hotel room, change a flight, purchase an insurance policy or manage a service. In many of these scenarios, the conversation itself may become the primary commercial interface.
But one essential condition remains:
The customer must be able to complete a secure, authenticated payment without the conversation itself preventing the authentication mechanism from operating.
Indiscriminate ACD restrictions during active calls could introduce friction into such experiences. It would be contradictory to invest in increasingly capable conversational agents while blocking legitimate bank authentication simply because a payment is taking place during a telephone conversation.
This does not mean that all future Voice Commerce will depend on 3RI TO=09. It means security interoperability will become increasingly important for conversational payments.
10. From Voice Commerce to Agentic Commerce: Building Tomorrow’s Trust Infrastructure Today
Conversational payments may develop across three models.
Human ↔ Human Agent
This is the traditional contact-centre experience: a customer talks to an agent to purchase a product or service and make a payment. EMV 3DS 3RI TO=09 offers a means of involving the issuer in authentication without necessarily sending an external payment link.
Human ↔ AI Agent
Here, an AI assistant understands the customer and manages the commercial interaction. Authentication must still be completed by the cardholder through mechanisms established by the issuer. Decoupled authentication could be particularly useful where technically supported.
AI Assistant ↔ AI Agent
In future Agentic Commerce, a personal AI assistant authorised by the consumer may interact with a merchant’s AI agent to search, compare and purchase goods or services.
Automating the commercial interaction does not eliminate the need to verify payment legitimacy. The ecosystem will require mechanisms for consent, delegation of authority, permitted limits and linking an authorisation to a specific transaction.
EMV 3DS is a widely recognised payments authentication framework with capabilities relevant to this evolution. However, TO=09 applies to telephone orders and must not automatically be extended to every AI-to-AI transaction. Agentic Commerce will need additional identity, delegation and authorisation mechanisms.
Deploying authenticated telephone payments today can help build the expertise and interoperability useful to the next generation of payments.
The Role of Passkeys
Passkeys use FIDO standards and phishing-resistant cryptographic mechanisms. Visa and Mastercard are promoting Payment Passkey initiatives intended to improve cardholder authentication and reduce friction.
EMV 3DS supplies an authentication framework within card payments, while passkeys can provide a cryptographic mechanism for cardholder verification.
Their possible use within decoupled authentication depends on issuer, ACS and scheme support. It would be incorrect to assume every 3RI TO=09 flow already supports passkeys, or that passkeys alone address all transaction authorisation and delegated-consent requirements.
Three Complementary Capabilities
EMV 3DS: an international authentication protocol for the use cases defined by the standard.
Passkeys: cryptographic mechanisms for robust cardholder verification.
ACD: active-call detection and signals associated with potential telephone-based social engineering.
Contextual risk analysis, delegated-authority controls and consent mechanisms can complement these capabilities. ACD is especially relevant when an actual telephone call exists; other controls will protect automated agent-to-agent transactions without calls.
We do not need every technology in every transaction. We need technologies to work together where appropriate.
11. A Call for Industry-Wide Collaboration
ACD–EMV 3DS interoperability cannot be solved by one company alone. It requires issuing banks, ACS providers, mobile-security vendors, PSPs, card schemes and large merchants.
Issuers know the policies applied in their apps; ACS providers manage authentication; ACD vendors understand call-related signals; PSPs connect commercial and banking infrastructure; and merchants can contribute operational evidence across high transaction volumes and multiple issuers.
Pay by Call believes that technical dialogue should examine:
- When ACD policies may prevent legitimate authentication.
- Which contextual data ACS platforms can assess.
- How to retain vishing protection without indiscriminate blocking.
- Which additional risk-analysis mechanisms are necessary.
- How to improve interoperability across the ecosystem.
- How to prepare authentication infrastructure for conversational and agentic payments.
The French initiative to strengthen telephone payment security provides a relevant context for this discussion. Its lessons may extend well beyond France.
12. Conclusion: Protecting Consumers Should Not Mean Preventing Secure Payments
As commerce becomes more conversational and automated, payment systems will have to preserve both security and usability. The two objectives should reinforce each other. A payment customer should be protected from manipulation during a suspicious call, but a genuine customer should not face an unnecessary barrier merely because a legitimate purchase happens during a telephone conversation. Achieving that distinction will require appropriate risk assessment and coordination among the different security technologies involved.
The payment ecosystem is evolving towards increasingly automated and conversational models.
Artificial intelligence will transform commercial relationships. Passkeys can improve authentication experiences. EMV 3DS will continue to provide important capabilities for card-not-present authentication. Active Call Detection will remain a useful tool against telephone fraud.
All these technologies share an objective: protecting the customer. The challenge is making them work together.
Today, billions of existing MOTO transactions could evolve towards authenticated telephone payments.
Tomorrow, AI agents will take part in increasingly complex commercial interactions.
We have an opportunity to connect these realities through interoperable authentication infrastructure, rather than allowing two fraud-prevention mechanisms to work against each other.
This should not be framed as a choice between ACD and EMV 3DS 3RI. It is an opportunity to combine their strengths and improve security across the ecosystem.
Merchants need to protect transactions, authenticate customers and, where eligible, benefit from the fraud-liability protections established by card schemes.
We do not need less fraud prevention. We need smarter, context-aware and interoperable fraud prevention.
The future should not be Voice Commerce without security—or security that prevents Voice Commerce.
The future must be Secure Voice Commerce.
And we should start building it today.
About Pay by Call
Pay by Call, S.L. is a Spanish technology company specialising in secure telephone payments, certified to PCI DSS Level 1 and Spain’s National Security Framework (ENS High).
Its PBC PCIaaS platform protects cardholder data across assisted-payment and self-service channels, integrating with banks, PSPs and contact-centre infrastructure.
Through PBC 3DS (patent pending), the company is promoting the transition from traditional MOTO payments to Authenticated Telephone Orders (ATO) through EMV 3DS authentication orchestrated during the call.
Pay by Call operates through a bank-agnostic, PSP-agnostic and communications-platform-agnostic model.
PBC PCIaaS + PBC 3DS = ATO
José Chillerón
Co-Founder & Chief Strategy Officer
Sources and References
- ECB / Pay by Call. MOTO Market in Spain and the European Union, 2024–2025.
- Federal Reserve. Federal Reserve Payments Study — NPIPS Detailed Data, Table 1, ‘Mail-order/telephone-order’, 2022. MOTO card-payment count, value, published average and annual growth rates.
- Banque de France / OSMP. Fraud Prevention Measures on Remote Card Payments Outside 3-D Secure — Recommendation No. 5.
- EMVCo. Publication of EMV 3DS Version 2.2.0, 14 December 2018.
- EMVCo. Decoupled Authentication and 3RI Transactions.
- Visa. European EMV 3DS 2.2.0 Implementation Guide.
- Visa. 3-D Secure: Authentication and Fraud Protection.
- Mastercard. Identity Check Program Guide. General authentication and operating requirements; the precise scope of TO=09 liability shift must be checked against current scheme rules.
- Wultra. Active Call Detection — Technical Documentation.
- Outseer. Active Call Detection and Fraud Prevention.
- Visa. Visa Payment Passkey.
- Mastercard. Mastercard Payment Passkeys.
Methodology note: US 2022 figures reflect the Federal Reserve’s reported precision (3.0 billion payments; $0.87 trillion; $293 published average); they are not unrounded, transaction-level totals. EU and US MOTO statistics refer to different reporting years. Estimates for the United Kingdom, Brazil and Mexico are Pay by Call extrapolations rather than official MOTO statistics. MOTO transaction values measure gross payments processed and should not be compared directly with commercial Voice Commerce market estimates using different definitions or revenue metrics without a consistent and verifiable methodology.
© Pay by Call, S.L. · November 2026