Contents
When processing card payments over the phone what should you do to ensure compliance with the PCI DSS?
Adhere to a strict information security policy. If calls are being recorded, ensure media is clearly labeled, inventories are rendered unreadable following PCI security standards. Implement proper user authentication for staff. Display no more than the first six and last four digits of PAN data.
Does PCI DSS apply to paper records?
When keeping cardholder data on hardcopy/paper, requirements 9.5 through 9.8. 2 (PCI DSS 3.0) apply. These controls include secure storage of the paper documents, proper access control to the paper documents, destruction of the paper documents when no longer needed, etc.
Is it legal to take card details over the phone?
Businesses that take card payments over the phone are required to adhere to the Payment Card Industry Data Security standard (PCI DSS) compliance regulations. Businesses that don’t may be liable for non-compliance fines, and may be forced to stop accepting payments by card.
Is the PCI DSS compliant for call recording?
This obviously introduces a significant extra administrative burden and can also be subject to human error.
What is PCI compliance call recording and transcription?
PCI compliance call recording & transcription refers to the requirements set in the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is a set of strict regulations created to protect private financial information and prevent credit card fraud.
Can a PCI card be used for a voice recording?
If a customer reads out their card details to your agent and those details are then captured in the call recording then you may be in breach of PCI DSS regulations, particularly if you’re then storing the PAN and CV2 numbers as part of the voice recording.
Can a telephone call center be PCI compliant?
Depending on how much of the above you use, complying with PCI for telephone-based payments can be seriously challenging. Physical security of the call center/contact center is also within the scope of a PCI DSS assessment as are the Human Resources involved in taking payments over the phone.