Do call recordings have PCI DSS requirements?

My company records the phone calls where payments are made using credit cards, but I'm not sure how to handle that...

data. What are the PCI DSS regulations for call recordings?

Call centers around the world use recording systems for quality assurance and training purposes. In the world of telephone credit card acceptance, it is inevitable that the call recordings from those systems will contain credit card information. Operations like the one described are commonplace and require careful security attention.

The Payment Card Industry Security Standards Council recognized this special need and, in 2011, issued a document entitled Protecting Telephone-Based Payment Card Data. This guidance document clarifies how PCI DSS applies to call centers and, in particular, call recording operations. The bottom line is that any recording systems that might capture payment card data must be considered in scope for PCI DSS and comply with all of the PCI DSS requirements.

There are special considerations, however, for call centers where recordings may capture sensitive authentication data, such as credit card security codes. Call recordings with this information may not be stored unless absolutely necessary and PCI DSS requires that merchants follow several steps. First, they must attempt to configure their system to prevent the recording of sensitive authentication data. If this is not possible, they must attempt to implement processes that delete this data after authorization.

If merchants are unable to prevent recording and are also unable to delete existing call recordings, they must document the reasons for this gap, conduct a risk assessment and implement controls that ensure it is not possible to query sensitive authentication data.

Ask the Expert:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today. (All questions are anonymous.)