PCI DSS by industry
PCI DSS for call centres and BPOs: card payments by phone, call recordings and the AOC your clients expect
What changes when card numbers arrive by phone: why BPO clients write PCI DSS into the contract, how recordings, pause-and-resume and keypad masking shape the scope, where assessors sample on the floor, and how it sits beside SOC 2, ISO/IEC 27001 and HIPAA.
Key points
- When agents take card numbers by phone, every desktop, recording and floor that hears or captures them is in the cardholder data environment unless you design it out.
- A call recording that holds the security code a customer read aloud is stored sensitive authentication data, which the standard never permits after authorisation.
- Pause-and-resume keeps card details out of the recording but leaves the agent in scope; DTMF masking can keep them away from the agent as well.
- A BPO handling card data for clients is a service provider, and clients will ask every year for your Attestation of Compliance and a split of responsibilities.
Why call centres and BPOs are asked for PCI DSS
For an outsourced contact centre the demand rarely starts with a card brand. It starts with a client, such as a retailer, airline, utility or subscription business, whose acquirer holds it accountable for everyone who touches its customers' cards. Its vendor risk team asks for your AOC and writes PCI DSS into the master services agreement before a payments queue goes live.
A business that handles card data on behalf of another entity is, in the standard's vocabulary, a service provider, so a BPO taking payments for clients validates as one, not as a merchant. Mastercard, for example, expects its top service provider level to be assessed by a QSA with a Report on Compliance; lower levels may self-assess, and SAQ D for Service Providers is the only questionnaire open to them. Levels are set by the card brands' programmes; see Do you need PCI DSS? Merchant levels, service providers and who decides.
What falls into scope on a contact centre floor
Trace one payment call. The card number travels through the carrier, the telephony platform, the agent's softphone, the screen where it is keyed, the client's payment page or virtual terminal, and any recording, quality or speech analytics tool that keeps a copy. Everything on that path, and everything with unrestricted connectivity to it, is in the CDE.
Three choices decide how large that becomes:
- Recording everything: card numbers land in the archive, which then needs full stored-data protection, and security codes must not be kept at all.
- Pause-and-resume: recording stops while card details are spoken. The archive is cleaner, but the agent still hears and keys the number, so desktop, network and floor stay in scope, and a missed pause is an incident.
- DTMF masking or a payment IVR: the customer keys the digits, the tones are hidden from agent and recording, and the data goes straight to the payment provider.
The QSA confirms the resulting boundary. Typical mistakes: omitting home agents, forgetting chat and e-mail queues where customers type card numbers unprompted, and assuming the telephony vendor's AOC covers your configuration. Method: PCI DSS scoping and segmentation: shrinking the CDE.
Where the requirements bite for BPO and contact centres
| Requirement area | What it means for a payments floor | Evidence the assessor samples |
|---|---|---|
| 3 Protect Stored Account Data | No security codes in recordings, notes or tickets; any card number kept is unreadable and purged on schedule | Data discovery across recordings and case tools, sampled calls, purge records |
| 4 Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks | No card numbers by chat, e-mail or messaging; any sent over public networks travel under strong cryptography | The agent rule, chat redaction settings, the encryption and certificate inventory |
| 7 and 8 Access by need to know, and authentication | Only payment-queue agents reach payment screens; individual logins; MFA into the CDE and on all remote access | Queue-to-role access model, leaver removals, six-monthly reviews, MFA settings |
| 9 Restrict Physical Access to Cardholder Data | Payment floors are controlled zones with clean-desk and no-phone rules | Badge and visitor logs, floor walk results, paper destruction records |
| 12 Organisational policies and programmes | Agents screened and trained before their first payment call; each client's split of responsibilities written down | Training dated before go-live and yearly, screening records, responsibility matrices, an incident plan covering a missed pause |
The full twelve are in PCI DSS requirements explained, requirement by requirement.
PCI DSS alongside SOC 2, ISO/IEC 27001 and HIPAA
Outsourcers usually carry several demands at once: US clients may want a SOC 2 report beside your AOC, others an ISO/IEC 27001 certificate, health work adds HIPAA, and revenue-critical seats raise continuity under ISO 22301. Each has its own assessor, but one access model, joiner and leaver process, floor control set and training record can feed them all. See SOC 2 for BPO and shared services and PCI DSS vs ISO/IEC 27001 and SOC 2.
Your telephony, masking and recording vendors each need a current AOC in your provider register; see How to verify a PCI DSS AOC and check a provider's compliance.
What a contact centre engagement looks like
Duration depends on the sites and client programmes taking payments, whether a payment technology change is planned, how access ties to HR records, and the client's contract date. Operations, telephony, IT security, facilities, HR, quality and each payments account lead take part. With Design™, Sterling guides your teams to run the controls; with Drive™, Sterling carries more of the scoping, evidence and internal assessment so campaigns keep their service levels.
The IT risk manager writes that the engagement clarified the company's responsibilities across payment processes, technology environments and internal controls, and that the structured approach, evidence review and readiness activities helped it organise its compliance effort and strengthen security practice.
How Sterling works with BPO and contact centres
Card numbers kept off the floor, and an AOC your clients accept.
Our expert and experienced consultants trace every payment call path, weigh pause-and-resume against keypad masking, test agent access and recordings the way a QSA will, and keep the evidence in Effivity, included with the engagement, at no additional cost. Sterling does not validate compliance; the QSA assesses and attests. We ensure successful validation for our clients.
Book a free discovery callPCI DSS for call centres: questions BPO buyers ask
Can a call centre record calls where customers give card details?
Yes, but the recording must never keep the security code, and any card number in it must be protected as stored account data. Pause-and-resume or keypad masking keeps card details out of the archive.
Does DTMF masking take our agents out of PCI DSS scope?
It can, when agents and recordings never receive the card digits and the masking provider holds a current AOC. Your QSA confirms the boundary, and the provider still belongs in your register.
Is a BPO a merchant or a service provider under PCI DSS?
A BPO that handles card data on behalf of clients is a service provider. It validates as one and shares its AOC with the clients who rely on it.
Do work-from-home agents who take card payments need to meet PCI DSS?
Yes, if they hear, key or can reach card data. Expect managed devices, MFA on remote access and a private workspace rule, or keypad masking so they never handle the number.
PCI DSS by industry
Every guide in the PCI DSS series is written for one question and links back to the hub for the whole picture.
- PCI DSS assessor questions
- PCI DSS in Australia
- PCI DSS for banking and financial services
- PCI DSS for BPO and contact centres
- PCI DSS checklist
- Choosing a QSA
- PCI DSS common mistakes
- PCI DSS for e-commerce and retail
- PCI DSS for fintech and payment facilitators
- PCI DSS for healthcare providers and insurers
- PCI DSS for hospitality and travel
- PCI DSS for software and hosting providers
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Talk to a consultant
Plan a PCI DSS programme that keeps card numbers off your contact centre floor.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice