My company records the phone calls where payments are made using credit cards, but I'm not sure how to handle that...
data. What are the PCI DSS regulations for call recordings?
Call centers around the world use recording systems for quality assurance and training purposes. In the world of telephone credit card acceptance, it is inevitable that the call recordings from those systems will contain credit card information. Operations like the one described are commonplace and require careful security attention.
The Payment Card Industry Security Standards Council recognized this special need and, in 2011, issued a document entitled Protecting Telephone-Based Payment Card Data. This guidance document clarifies how PCI DSS applies to call centers and, in particular, call recording operations. The bottom line is that any recording systems that might capture payment card data must be considered in scope for PCI DSS and comply with all of the PCI DSS requirements.
There are special considerations, however, for call centers where recordings may capture sensitive authentication data, such as credit card security codes. Call recordings with this information may not be stored unless absolutely necessary and PCI DSS requires that merchants follow several steps. First, they must attempt to configure their system to prevent the recording of sensitive authentication data. If this is not possible, they must attempt to implement processes that delete this data after authorization.
If merchants are unable to prevent recording and are also unable to delete existing call recordings, they must document the reasons for this gap, conduct a risk assessment and implement controls that ensure it is not possible to query sensitive authentication data.
Ask the Expert:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today. (All questions are anonymous.)
Test your PCI DSS vocabulary knowledge with this quiz
Find out if PCI DSS regulates mobile payment security enough
Discover the effect of tokenization on PCI DSS compliance
Dig Deeper on PCI Data Security Standard
Related Q&A from Mike Chapple
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ... Continue Reading
The HHS OCR ruled that healthcare ransomware attacks are HIPAA violations, so these covered entities need to react according to the HHS's guidance. ... Continue Reading
HIPAA regulations incorporate NIST guidelines and standards, so do healthcare organizations need to be compliant with both? Expert Mike Chapple ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.