Guide
PCI DSS IVR and phone payments: keeping agents out of scope
PCI DSS IVR questions come up whenever customers pay by phone. If agents hear card numbers or calls are recorded, a large part of your operation falls into scope, so the design choice matters.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
Why PCI DSS IVR design matters for phone payments
Card numbers spoken aloud reach agents, headsets, desktops and recording systems. Therefore each of those can enter scope. Also, security codes must never be stored after authorisation, which includes recordings. The standard is in the PCI SSC document library.
Options for PCI DSS IVR and call centres
Several designs reduce scope. However, they differ in cost and customer experience.
| Approach | Effect on scope |
|---|---|
| Agent hears and types numbers | Agents, desktops and recordings in scope. |
| Pause and resume recording | Helps, but relies on agents every time. |
| Keypad entry with tone masking | Agents never hear numbers, so scope shrinks. |
| Transfer to a hosted IVR | Card entry handled by the provider. |
PCI DSS IVR check
Tick each statement that is true.
Your result appears here as you tick, so you can see what is still open.
PCI DSS IVR and call recordings
Search existing recordings and transcripts for card data. For example, a call where a customer read out the security code is stored sensitive data. So include recordings in your data discovery.
- Call recordings and backups
- Speech-to-text transcripts
- Quality monitoring tools
- Ticket notes written during calls
Choosing a PCI DSS IVR design
Weigh call volume, cost and agent workflow. For example, a small team taking few phone payments may manage with careful procedures, while a busy call centre usually benefits from keypad masking.
Whatever the choice, document it. Assessors want to see how card data moves through the call, and a clear diagram answers most of their questions.
Where we help
We map the call flow, find stored data and compare scope-reduction options. However, we are not a QSA, and we do not sell telephony products.
Also train agents on what to do when a customer starts reading out a card number at the wrong moment, because procedures fail most often in those unexpected moments.
PCI DSS IVR questions
Does PCI DSS IVR guidance allow call recording?
Yes, but recordings must not keep security codes, and card data must be protected.
Is pause and resume enough for PCI DSS IVR?
It helps, but it relies on people, so mistakes happen.
What is keypad masking?
Customers type digits on their phone, and tones are hidden from the agent.
Do you sell phone systems?
No. We stay independent.
Related guides
Map your phone payment flow
Describe how phone payments work today. We reply in writing with scope options and a budget range.
Ask us anything