Pay by link in Canada: how payment links work and when to use them.

The short answer

• A link is for a customer who is not there. They type their own card details on a page your provider hosts. Your staff never see the card number.
• It is priced as card-not-present. Visa defines that as a sale where the card and the cardholder are not at your location. See our fees guide.
• Disputes are the main risk. Use the checks your provider offers, keep records and make the charge easy to recognize.
• Pick the right tool. A link suits a known amount. An invoice suits a bill with line items. A virtual terminal suits staff taking a card by phone.
• No card fee for Québec consumers. The OPC says merchants may not charge consumers a fee for paying by credit or debit card.

Where payment links earn their place

For a customer at your counter, a tap on a terminal is faster and priced as card-present.

How a link works, step by step

1. You create the link in your payment tool, with an amount and a description.
2. You send it by text, email or chat, or add it to an invoice or quote.
3. The customer opens it and enters their card details on the hosted page.
4. The sale goes through the gateway and your processor for approval.
5. The customer gets a receipt, and the tool records the payment against your reference.
6. Funds settle to your bank account with your other card sales.

What to set before you send one

How Authorize.Net handles links

CleverPays sells Authorize.Net, so here is what its own documentation describes.

• Invoicing. You create an invoice with the customer's email, an invoice number, a due date and up to 30 items. The customer gets an email with a link to a hosted payment form. Statuses run from Draft and Sent to Partial, Paid or Canceled. Partial payments are possible if you turn them on and set a minimum. Reminders go out 5 days and 1 day before the due date unless you opt out. If you change the customer's email, the old link is cancelled.
• Simple Checkout. You create a payment button for an item or a donation. Authorize.Net gives you a website address for it that you can send to any customer. That makes it a reusable link. You can set a custom receipt page.
• Accept Hosted. A hosted payment form for your website or app. Its form token lasts 15 minutes, so it suits a checkout page more than a link sent by email.

Security and PCI scope

With a hosted payment page, the customer types the card number on your provider's page, not into your systems. That keeps card data off your computers and out of your staff's hands.

PCI DSS is the card industry's security standard. Its questionnaire SAQ A is for card-not-present merchants who outsource all card data handling to PCI-compliant providers. Those merchants do not store, process or send card data electronically on their own systems. The PCI Security Standards Council gives "an email with a link" to a provider's website as an example of fully outsourcing payment. It also tells merchants to confirm with their acquirer or the card brands which questionnaire applies.

So a link can shrink what you have to secure, but your acquirer decides which form you fill in. Do not write card numbers on paper or in email to "help" a customer. That brings card data back into your business. See our PCI DSS glossary entry.

What payment links cost

A link sale is card-not-present. Visa Canada publishes separate interchange rates for card-present and card-not-present sales, and card-not-present rates are usually higher. Interchange is the fee the card issuer receives on each sale. On interchange-plus pricing, you see it as its own line. On flat pricing, it sits inside one rate, which may differ for online and keyed sales.

Some link tools also charge a monthly fee or a fee per transaction. Ask for those as separate lines. Our card processing fees guide shows each layer, and the payment link glossary entry has a worked example.

Chargebacks on card-not-present sales

A chargeback is a sale the customer disputes with their bank. Card-not-present sales are more exposed, because no card was read in person. These steps lower the risk. None of them removes it.

• 3-D Secure. Visa says Visa Secure helps prevent card-not-present fraud. The issuer checks the payer, sometimes with a one-time code. Ask whether your link page supports it. See 3-D Secure.
• Address and card code checks. Authorize.Net's address check (AVS) compares the billing address with the issuer's record. Its card code check compares the 3-digit code, or 4 digits on American Express. One AVS response code means a non-U.S. issuing bank, so ask how the address check behaves on Canadian cards.
• A name the customer recognizes. Ask your provider what name shows on the customer's card statement. Use the one they know you by.
• Records. Keep the quote, the signed work order, the delivery or completion proof and the messages. That is your reply if a dispute arrives.

Link, invoice or virtual terminal

Québec: no fee on consumer payments

The Office de la protection du consommateur says merchants may not charge consumers a fee for paying by debit or credit card. A warning sign does not make the fee legal. A link sent to a Québec consumer must show the same price as any other way to pay. Outside Québec, credit card surcharges follow card network rules. See our surcharging guide, and check with your lawyer or acquirer before you add one.

Where CleverPays fits

Visa, Mastercard and the other card networks write the rules. The customer's bank approves the sale and decides disputes, and your processor settles the funds. The link tool belongs to the provider that makes it. You own the price, the description and the records.

We can review your current statement with you, line by line. We can set up a link tool, such as Authorize.Net invoicing or Simple Checkout, with a merchant account behind it. We can connect it to how you bill, test a payment, a refund and the first deposit with you, and stay your contact in English and French.

Common questions