1

If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit card information?

Improve this question

2 Answers 2

Reset to default
2

In order to be PCI DSS compliant, they are expected to meet the requirements of Protecting Telephone-based Payment Card Data, a PCI Security Standards Council document. It's complex, but generally requires that they limit recording of card details as much as possible, store them encrypted if they must be stored, and never store Sensitive Authentication Data (your CVV). The document provides this direct guidance:

What to Ask Your Call-Center Provider

How does the call-center system help my company comply with the PCI DSS requirements, and how does it automatically remove sensitive credit card information from recorded calls?

If you take credit card details over the phone, ask your supplier to prove that they are “PCI DSS compliant” and to explain how they remove sensitive authentication data from their recordings, automatically (with no manual intervention by your staff).

In practice, you can usually tell a compliant provider because they will briefly transfer you to enter your CVV to a program using the buttons on your phone, then transfer you back to continue speaking with the representative. That's how they avoid recording your CVV.

To be clear, they're allowed to record your card number, so long as they protect it (encryption, generally). No matter how you transmit your card number to a merchant - online, in person, on the phone, or via paper mail - they're allowed to store your card number. And it is necessary for either them or their processor to store it for a significant period of time as part of the regular card process.

Improve this answer
1

It depends, but usually companies, including call centers, keep records of the phone calls. There are various reasons, from regulations to the simple fact of having a proof in case of disagreements such as if you decide to sue them for any reasons. I would say having you credit card number as long as they don't have as well other data (such as PIN, expiration date, CVV code, password to an online bank app) is not the end of the world, but still it's not nothing.

Improve this answer
1
  • 1
    I have not run across any call center that did not record calls as a matter of course. Either random calls, or if calls triggered some sort of quality metric that would require later review.
    – schroeder ♦
    Oct 12, 2018 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .