[teh_klev]

It's very common in the UK and known as a "Cardholder Not Present" transaction. The merchant needs explicit permission from their payment provider to be able to process these transactions either via their handheld terminal or an equivalent "terminal" running on their PC or payment provider website.

There are strict rules about not writing down cardholder details etc as well. You're correct, these are riskier transactions and the cost per transaction can be higher for the merchant to be able to accept payments this way.