Is taking credit card information over the Phone PCI compliant?

Many business owners have asked us how to accept credit card information over the phone in a PCI compliant manner. The good news is that you can take credit cards over the phone (or hand key a customer’s credit card information) and be PCI compliant!

Can credit card number be captured over voice transmission?

It is a violation of PCI DSS Requirement 3.2 to store any sensitive authentication data, including card validation codes and values, after authorization even if encrypted. It is therefore prohibited to use any form of digital audio recording (using formats such as WAV, MP3, etc.)

Is it legal to save credit card information?

While it is not illegal for businesses to retain credit card information, several watchdog groups and government agencies advise against the practice to avoid customer information being compromised.

Are call center calls recorded?

“This call may be monitored or recorded for quality and training purposes…” For some, it’s not a matter of choice: industry regulations mandate that call centers record some or all of their customer transactions.

Is it illegal to write down a credit card number?

NEVER physically write down any credit card information unless you are explicitly required to do so as part of your business processes. NEVER acquire or disclose any cardholder’s credit card information without the cardholder’s consent, including but not limited to: the partial sixteen (16) digit card number.

What is a compliance call?

Compliance recording is the legally required process of capturing (recording) phone calls in a manner that adheres to local, national, and global regulations. Call recordings have been used to improve the commercial goals of many companies, the principal aim of call recording is contact center compliance.

Is it legal to take payments over the phone?

Businesses that take card payments over the phone are required to adhere to the Payment Card Industry Data Security standard (PCI DSS) compliance regulations. Businesses that don’t may be liable for non-compliance fines, and may be forced to stop accepting payments by card.

Can companies keep credit card details?

Alarmingly, according to the Association of Payment Clearing Services, companies can keep customer card details indefinitely, provided that they are stored safely and not misused.

Do you need to tell customers calls are recorded?

Nonetheless, businesses are under no obligation to inform you if they are recording calls for any of the following reasons: Provide evidence of a business transaction. Ensure that a business complies with regulatory procedures. See that quality standards or targets are being met in the interests of national security.

How do I stop people recording my calls?

How to Block Call-Recording Devices

1. Check the phone line coming from the wall to your phone, and check the line coming into your house from the telephone box.
2. Buy a bug detector.
3. Detach the phone line from the phone and plug it into the bug detector.
4. Check your cell phone’s battery.

How to prevent payment card data from being recorded?

Manual pause/resume should be subject to periodic QA review to ensure the pause is effective to prevent payment card data from being recorded. 4. Never Write Down Card Information on Slips Of Paper.

Is there a way to redact credit card information?

If your business records customer phone calls, make sure that there is a way to redact credit card information. Ideally, your call recordings will use a system integrated with the order entry system and pause the recording when the agent gets to the payment page and resume recording after the card has been entered.

Can a call be recorded for a PCI audit?

Instead, it uses speech analytics technology to prevent sensitive cardholder data from being recorded; call recording is automatically muted when account numbers, security codes, and other sensitive information is spoken. Because Redactor prevents you from recording sensitive payment information, calls are not in scope for a PCI audit.

How does PCI work in a call centre?

There’s no interruption in the service, as the agent remains on the line whilst the customer enters their card details using their phone keypad. The numbers are then communicated electronically to your Payment Services Provider for authorisation, and the customer data never enters your call centre or call recording.

Is taking credit card information over the phone PCI compliant?

Many business owners have asked us how to accept credit card information over the phone in a PCI compliant manner. The good news is that you can take credit cards over the phone (or hand key a customer’s credit card information) and be PCI compliant!

How do I complete PCI compliance?

In the journey to becoming PCI compliant, there are 12 steps you must complete, which the SSC separate into 6 separate goals.

1. Building and maintaining a secure network.
2. Protect cardholder data.
3. Maintain a Vulnerability Management Program.
4. Implement strong access control measures.
5. Regularly monitor and test networks.

Is it against the law to write down credit card numbers?

NEVER physically write down any credit card information unless you are explicitly required to do so as part of your business processes. NEVER acquire or disclose any cardholder’s credit card information without the cardholder’s consent, including but not limited to: the partial sixteen (16) digit card number.

Can a company keep my card details on file?

Alarmingly, according to the Association of Payment Clearing Services, companies can keep customer card details indefinitely, provided that they are stored safely and not misused.

How many digits can be displayed on PCI 3.3?

3. PCI Requirement 3.3 states that the 16-digit Primary Account Number (PAN) must be masked when displayed. The maximum that can be displayed are the first six and last four digits. The full PAN can only be displayed for those users whose roles include a legitimate business need to view the full PAN.

Can a PCI DSS display a credit card number?

The PCI DSS permits the display of card holder data for valid business purposes – but that comes with taking on full liability and penalties if any of your customers’ cards are misused for fraud. Such display puts you directly in harm’s way, and from a risk avoidance viewpoint I would very strongly discourage your implementation of this function.

What is the PCI standard for credit cards?

The Payment Card Industry Data Security Standard (PCI-DSS) is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.

Do you have to be PCI compliant with debit card?

A: If you accept credit or debit cards as a form of payment, then PCI compliance applies to you. The storage of card data is risky, so if you don’t store card data, then becoming secure and compliant may be easier. Q12: Are debit card transactions in scope for PCI?