Taking card payments by phone under PCI DSS.
If you take card payments by phone, PCI DSS expects you to keep card details out of your call recordings and notes. The simplest way is not to have customers read out card details at all: send them a secure payment link instead.
This page is general guidance, not legal or compliance advice. IBIOS does not record calls, and it has no feature that stops or restarts a recording; your phone provider makes the recordings. What IBIOS does today is let staff send a pay by link and record the payment against the job.
Why is recording card details on a phone call a risk?
A customer phones to pay their balance. Your staff member asks for the card number and the customer reads it out, along with the expiry date and security code. If the call is being recorded, the recording now holds card data.
PCI DSS does not allow the card security code to be stored after a payment is authorised, and card numbers have to be protected wherever they are kept. A recording that holds them brings that audio file, and everyone who can listen to it, into the scope of the standard.
Relying on staff to remember a manual step under pressure is fragile. It is usually better to change how payment is taken so that card details are not spoken on a recorded call in the first place.
How can you take card payments by phone without recording card details?
The common options, from simplest to most involved. Check the details with your card payment provider and your phone provider.
Send a pay by link instead
The customer pays on the payment provider’s secure page, so card details are never spoken to your staff. In IBIOS, staff send the link through SumUp or Stripe and the payment is recorded against the job.
Take card details on a line that is not recorded
If you must take card details by phone, do it on a call that is not being recorded, and never write the details down.
Ask your phone provider about its options
Some phone systems can stop recording for part of a call, or let customers key card numbers on their phone keypad without staff hearing them. Ask your provider what it offers and how it works.
Limit who can hear recordings
Whatever you choose, keep recordings to the people who need them, keep them only as long as you need to, and tell callers that calls are recorded.
Where does IBIOS fit in?
IBIOS keeps card details off the phone by giving staff a payment link to send. From the job record, staff send a pay by link through SumUp or Stripe; the customer pays on the provider’s page, and the payment is recorded against the job in IBIOS Payments. IBIOS does not store card numbers.
IBIOS does not record calls. It writes call reports and call briefings from the recordings your phone provider already makes, so how card details are kept out of those recordings is a question for your phone provider.
What do people ask about card payments by phone?
Does PCI DSS apply to a small business taking card payments by phone?
Yes. PCI DSS (the Payment Card Industry Data Security Standard) applies to any business that accepts card payments, whatever its size. Your card payment provider will tell you which self-assessment questionnaire applies to you.
Can I record calls where customers read out card details?
You should keep card details out of call recordings. PCI DSS does not allow the card security code to be stored after a payment is authorised, and card numbers must be protected wherever they are kept. The simplest approach is not to have card details read out on a recorded line at all.
Does IBIOS stop call recordings during card payments?
No. IBIOS does not record calls and has no feature that stops or restarts a recording. Recording is done by your phone provider. If you take card details by phone, ask your phone provider how it keeps them out of recordings, or send the customer a pay by link instead.
What is the easiest way to keep card details off the phone?
Send the customer a secure payment link. They enter their card details on the payment provider’s page, not to your staff, so no card numbers are spoken on the call. In IBIOS, staff can send a pay by link through SumUp or Stripe.
Who should I ask about my PCI DSS obligations?
Start with your card payment provider or acquiring bank: they set which questionnaire you complete and can explain what is expected of you. For call recording, ask your phone provider what options it offers for keeping card details out of recordings.
Related reading
IBIOS (Integrated Business Intelligence & Operations System) is made by IBIOS Limited (NI743167), Northern Ireland. Access is by waiting list; there is no free trial.
Keep card details off the phone.
Send a pay by link and record the payment against the job. Early access by waiting list.