Accept card payments in Morocco without a terminal: remotely, at the counter or on your website
Accept card payments in Morocco without a terminal: a link by message, a QR poster at the counter or checkout on your website, and which one to choose.
Does Morocco accept card payments? For a business, yes, and without a terminal: a company in Morocco can accept card payments on a page hosted by ChariPay, where the customer types in their own card details. They reach that page in one of three ways: a link sent by message or email, a QR poster scanned at the counter, or the "Pay" button on your website. No device to rent, no card keyed in by you: the customer confirms with their bank through 3-D Secure, and the amount is available in your payment account as soon as the payment succeeds. Below: the three entry points, what your customer sees, what you receive, and a decision table.
Yes, you can accept card payments in Morocco without a terminal
ChariPay is a Moroccan payment platform, a PSP operated by Chari Money, a payment institution licensed by Bank Al-Maghrib. The idea fits in one sentence: card payments happen on a page hosted by ChariPay, which your customer opens on their phone or computer and where they enter their own card number. You have no device to plug in, and card data never passes through your hands.
Which cards? By default: Visa, Mastercard and Maroc Pay. Other methods can be enabled on request to the team, depending on your business.
What changes from one situation to the next is how the customer gets to that page: a link, a poster or your website. The sections below take them one at a time. If you want the full map of ways to get paid remotely, including e-commerce integrations, the guide to online payment in Morocco covers it.
A "virtual terminal" in Morocco: what the term really means
"Virtual terminal", "virtual POS": behind both terms lies the same need, taking a card without hardware. At ChariPay, that role is played by the hosted payment page, with one important difference: you never enter the card. Not over the phone, not on a keyboard, not by copying digits a customer sent you. The customer opens the page, enters their card and confirms with their bank.
That page has three entry points:
- a payment link, which you send to a customer who is not in front of you;
- a poster with a QR code, placed at the counter, in the window or on a stand;
- a checkout session, which your website creates when the buyer clicks "Pay".
For your customer, the experience is the same in all three cases: a page in your name, an amount in dirhams, a card to enter, a 3-D Secure confirmation. For you, the difference lies in how the payment request is created and which methods it accepts, and that is what decides which option to use.
Remotely: a link sent by message or email
The typical case: a customer orders by phone, on WhatsApp or by email, and you want to be paid before you deliver or start the job. A payment link is an amount and a description; the customer pays on a page hosted by ChariPay. It is shared as a link, a QR code, a printable PDF poster, by email or WhatsApp. It is single-use or reusable, with an expiry of your choice — 24 hours, 7 days, 30 days, never, or an exact date — and a clear status: active, paid, canceled, expired.
For a remote customer, use a single-use link for the exact order amount: it can be paid only once, and its status tells you without ambiguity whether the order is paid. A caftan maker in Fez, for example, confirms the order on WhatsApp, sends a link described "Embroidered caftan, size M", and packs the parcel when the link turns "paid". On the page of a single-use link, your customer can also choose cash: they receive a reference and pay it at an agency of the Chari network, an option for people whose card is not enabled for online payments.
Field-by-field setup is covered in the guide to creating a payment link; the full offer is on the payment links page.
See the page your customer will get: Start in test mode. Three fields (name, work email, company), an activation link sent by email to choose your password, then the portal, where you create a link and pay it with the test card, and where you create your test key if you integrate through the API. It is free, with no time limit and no approval to wait for: your business verification (KYB) only gates the move to production.
At the counter: a poster with a QR code
At the counter, the link changes form: it gets scanned. Without a developer, create a single-use link for the amount of the sale and show its QR code from the list of links. The customer points their phone camera at the QR code, the hosted page opens, they enter their card and pay. You have nothing to handle: you check in the portal that the payment came in.
A permanent poster, valid for every customer who scans it, requires a reusable link. From the portal, every payment link you create is single-use. The reusable link — one amount paid by several customers — is created through the API, with singleUse: false; once created, it shows up in the portal like the others. The printable PDF poster — it carries the QR code and the amount — is available from the link's page in the portal, or through the API.
Two rules to keep in mind. First, the poster takes cards: a permanent counter poster or QR code is a reusable link, and a reusable link only collects cards; cash goes through a single-use link, one reference per deposit. Second, the amount is the link's amount: a poster suits a fixed price, such as a group class, a flat-rate service or an entry fee.
Generating, printing and renewing a poster are covered in the guide to QR code payments.
On your website: a checkout session to the hosted page
If your website takes orders or bookings, the entry point is a checkout session. An order becomes a session: you create the session server-side, redirect the buyer to the hosted checkout — card with 3-D Secure — and receive the result through a signed webhook. Each session has a limited lifetime — 72 hours by default, expiresAt to shorten it — and is consumed only once.
Three things to know before you go this way:
- 1It takes a developer. Your server calls the API with your key, never the buyer's browser.
- 2It only collects cards. A checkout session created through the API does not accept cash; for a website customer who wants to pay at an agency, send them a single-use link.
- 3The redirect proves nothing. Confirm the order when the webhook arrives, never on the redirect alone: the redirect says the buyer came back, not that the payment is secured.
To see where the hosted page sits in the full chain of a payment (your website, the platform, your customer's bank) and to compare integration modes, read the page on the payment gateway in Morocco. For a simple "Pay" button on a website without orders, other setups exist, compared in the guide to the payment button on a website.
What your customer does: enter their card and confirm with 3-D Secure
Whatever the entry point, the customer journey is the same. They see a page in your name and the amount in dirhams. They enter their card, then confirm. Card payments go through 3-D Secure authentication: the cardholder confirms with their bank, which protects the merchant against most unpaid charges and disputes.
The other benefit is what you never see. Your customer enters their card on the hosted checkout, within a PCI DSS Level 1 certified scope: you never see a card number, and your self-assessment questionnaire is reduced accordingly — to be confirmed with your advisor or your acquirer. That is also why you should never ask for a card number by phone, message or email: the hosted page exists precisely so those digits do not go through you.
A payment can fail, for known reasons: abandonment during authentication, a decline by the issuing bank, incorrect details, suspected fraud. Many Moroccan cards are not enabled for online payments by default: the customer can check that setting with their bank, or choose cash if you sent them a single-use link. To measure and reduce these failures, read 3-D Secure and success rates.
What you receive after the payment
As soon as a payment succeeds — a card authenticated with 3-D Secure or a reference paid in cash at an agency — the amount is available in your ChariPay payment account and usable right away: transfers, bills, top-ups. "Available instantly in the account" does not mean "instant bank transfer": the payout to your bank remains a separate operation, automatic every night once a settlement account is configured in the portal, or by transfer on demand.
ChariPay is not a bank: your payment account is held by Chari Money. It complements your bank; it does not replace it.
Tracking requires no manual checking:
- Link or poster: you are notified in the portal of every payment; a single-use link turns "paid", while the reusable link behind a poster keeps collecting until it expires or you cancel it; the portal also shows where each link came from, dashboard or API.
- Session: the result reaches your server through a signed webhook, which is what you rely on to confirm the order.
- Cash: as soon as the network confirms the deposit, the link turns "paid" and you are notified in the portal.
Which option for which situation: the decision table
| Your situation | Option | Accepted methods | Developer needed? |
|---|---|---|---|
| Remote customer (phone, messaging, email), amount specific to the order | Single-use link | Card, or cash at an agency | No |
| Counter, shop window or stand, same price for everyone | QR poster of a reusable link, created through the API | Card only | Yes, once |
| Same price repeated remotely (registration, membership fee, session) | Shared reusable link, created through the API | Card only | Yes, once |
| Different amount for each customer, on site | Single-use link, QR code shown from the list of links | Card | No |
| Website with orders or bookings | Checkout session | Card only | Yes |
Without a developer, to sell several times at the same price, publish a product on your hosted storefront and share its link. A single business can combine several rows. A caterer in Casablanca can show the QR code of a single-use link at the counter for each sale, send a single-use link for each event order, and later have a developer add a checkout session to the website, along with the reusable link for the poster of the fixed-price menu of the day. All these collections land in the same payment account and are tracked in the same portal.
Frequently asked questions
Can a business accept card payments in Morocco without a terminal?
Yes. With ChariPay, your customer pays on a hosted page that they open themselves: a link received by message or email, a QR poster at the counter, or the button on your website. They enter their card and confirm with their bank through 3-D Secure. You have no device to rent or plug in, and you never handle the card data.
What is a virtual terminal, in practice?
It is the common name for a way to take a card without hardware. At ChariPay, that role is played by a hosted payment page: you create the payment request (link, poster or session), and your customer enters their own card on it. You never type the customer's card yourself, which is exactly what keeps their data out of your reach.
Which cards can my customers use by default?
By default: Visa, Mastercard and Maroc Pay. Other methods can be enabled on request to the team, depending on your business. On the page of a single-use link, your customer can also choose cash: they receive a reference and pay it at an agency of the Chari network. A poster or a checkout session, on the other hand, only collects cards.
Can I enter a customer's card myself over the phone?
That is not how ChariPay works: the customer always enters their own card on the hosted page, then confirms with their bank through 3-D Secure. On the phone, send them a single-use link by message or email during the call instead. Never ask for a card number out loud or in writing: it has no business being with you.
What is the difference between a link I send and a poster at the counter?
The link you send is usually single-use: one customer, one exact amount, one payment, and the option to pay cash at an agency. The permanent poster is a reusable link, created through the API: a fixed price, valid for everyone who scans it, and payable by card only. For a variable amount at the counter, show the QR code of a single-use link.
Does my customer need to install an app to pay?
No. Payment happens on a web page hosted by ChariPay, which opens from the link they received or when they scan the QR code with their phone camera. Only the 3-D Secure confirmation happens with their bank, using whatever method their bank provides to approve online payments. The same journey applies to a link, a poster or a session.
Does taking card payments remotely protect me against disputes?
Card payments go through 3-D Secure authentication: the cardholder confirms with their bank, which protects the merchant against most unpaid charges and disputes. It is not an absolute guarantee, but it is real protection. Also keep the exact description of each link: it documents what the customer paid for.
Next step
Before you choose, try all three entry points without committing a single dirham: Start in test mode. Create a single-use link, show its QR code from the list of links and scan it, and if you have a website, have your developer create a checkout session, or the reusable link for a poster, with the test key; pay each time with the test card 4918 9141 0719 5005, CVV 123, any future expiry date, 3-D Secure code 555. Then go deeper with the guide to QR code payments or the one on creating a payment link.
Written by ChariPay team.