Pay by Link: How Payment Links Work, Fees and Fraud

How a payment link works

A payment link is a URL that opens a checkout page hosted by a payment provider. You create it in the provider's dashboard, app or API with an amount, a description and sometimes an expiry date or a limit on the number of uses. You send it by text, email, chat or QR code. The customer opens it on their own device, enters card or wallet details, and the provider sends the payment for authorization. You get a notification and the payment appears in your account like any other online sale. Links can be single-use for one invoice or deposit, or reusable for a fixed-price item such as a class or a donation amount. Because the page belongs to the provider, you do not need a website, a shopping cart or a terminal to take the payment.

Payment link vs invoice

The two overlap, and many providers put a payment link inside every invoice. An invoice is a formal billing document. It carries line items, taxes, due dates, invoice numbers and payment terms, and it can send automatic reminders and record partial payments. A plain payment link is lighter: an amount and a pay button. Use an invoice when the customer's accounts payable team needs a document, when you bill net terms, or when you want reminders and aging reports. Use a link for deposits, phone orders, one-off balances and conversations that end with 'how do I pay you?'. Check pricing, because some providers charge the same for both and others add an invoicing fee or a monthly plan.

Card-not-present pricing

A payment through a link is a card-not-present transaction. The card is not tapped, dipped or swiped at a terminal, so card network interchange for these sales is generally higher than for card-present sales, and flat-rate providers usually publish a higher online rate. Keying a card number into a virtual terminal is also card-not-present. Many providers charge extra for manually entered cards because the business, not the customer, is handling the card number. For example, Square's US pricing page lists a separate rate for manual entry and card-on-file payments. With an interchange-plus provider the markup is fixed and the underlying interchange varies by card and transaction type. Compare the full cost per sale, including monthly fees, not just the headline percentage.

Published link and invoice pricing

The table shows fees each provider publishes on its own US pricing page, checked on 14 September 2026. Rates change and can differ by plan, card type, country and volume. Custom pricing is not shown. Confirm on the provider's page before you sign up.

Fraud controls: AVS, CVV and 3-D Secure

Hosted checkout pages usually support three main checks. The address verification service (AVS) compares the billing postcode or street address the customer enters with what the issuer has on file. The card security code (CVV2 or CVC2) check confirms the customer has the code printed on the card. Neither blocks a sale on its own. Your provider's settings decide whether a mismatch declines the payment. EMV 3-D Secure, maintained by EMVCo, sends transaction, device and payment data to the card issuer so the issuer can authenticate the cardholder. EMVCo describes two paths: a frictionless flow where the issuer approves in the background after a risk assessment, and a challenge flow where the customer confirms with a one-time passcode, a banking app or biometrics. Depending on network rules and the result, a successful 3-D Secure authentication can shift liability for some fraud chargebacks to the issuer. Ask your provider whether 3-D Secure is on by default and what it costs. Other useful signals are an unusual shipping address, many attempts from one device, and a customer asking you to send the link to a new number or email.

Phishing and spoofing risk

Payment links train customers to tap a link in a message and enter card details. Criminals copy that pattern with fake 'pay your balance' texts and emails. The more your messages look like everyone else's, the easier they are to imitate. Reduce the risk by sending only when the customer is expecting it, for example after a call, a quote or a completed job. Include your business name, the amount and what it is for. Tell customers in advance which channel you use and that you will never ask for card details by reply. Where the provider offers it, use a custom domain for the checkout page so the link shows your own brand. Stripe's pricing page, for example, lists a paid custom domain option. Avoid public link shorteners, which hide where the link goes. Give customers a way to check, such as a phone number on your website or an option to pay from their customer account instead.

Texting links: consent and sender identification

In the US, business text messaging runs on carrier rules as well as law. The CTIA Messaging Principles and Best Practices say message senders should get consumer consent, give clear disclosures about the type and purpose of messages, identify themselves, honor opt-outs such as STOP and keep records of opt-ins and opt-outs. Carriers now expect business texting from standard 10-digit numbers to be registered, typically through 10DLC campaign registration arranged by your texting provider. Toll-free and short code numbers have their own verification processes. Sending payment links from a registered, consistent number with your business name in the first line helps with delivery and with trust. Texting from a personal cell phone does neither. Consent rules under the Telephone Consumer Protection Act and state laws also apply. Get advice if you plan to text customers who have not contacted you first.

PCI scope: hosted pages and SAQ A

Because the customer enters card data on the provider's page, the card number never touches your systems. That is the main PCI benefit of payment links. The PCI Security Standards Council's FAQ 1588 (February 2025) addresses the SAQ A eligibility criterion about script attacks. It states that the criterion does not apply to merchants that redirect customers to a payment provider's page, or that fully outsource payment functions, for example by emailing a link to the provider's website. Those merchants still have to meet the other SAQ A conditions. These include using a PCI DSS compliant provider, not storing, processing or transmitting card data electronically on their own systems, and confirming the provider's compliance. Your acquirer confirms which questionnaire applies. You lose the benefit if staff take card numbers over the phone and type them into the link for the customer, or if you write card details down.

Refunds and disputes

Refund a link payment from the provider dashboard back to the original card. Most providers do not return their processing fee on refunds. Check each provider's terms. Card-not-present sales are open to 'I did not authorize this' fraud claims and 'not as described' disputes. Keep evidence together: the quote or invoice, the message thread showing the customer asked for the link, the delivery or job completion record, AVS and CVV results, and the 3-D Secure authentication result if one exists. Put your refund policy on the invoice or checkout page. Use a billing descriptor the customer will recognize. Respond to dispute notices before the deadline your provider sets, since a missed deadline usually means the dispute is lost.

Where payment links fit

Links suit businesses that sell remotely or finish work away from a counter. Examples include trades and field service deposits, professional services, tutors and coaches, event bookings, phone orders for restaurants and retailers, and balances after an in-store visit. They are less suited to high-volume counter sales, where a terminal is faster and card-present pricing is usually lower, and to recurring billing, where stored-card subscriptions or invoices with autopay are easier to manage. Many businesses use all three: a terminal in person, links for remote one-off payments, and invoices for accounts on terms.