Taking Card Payments by Phone: A Plain-Language Guide to PCI Rules

What PCI is and who it applies to

PCI DSS stands for the Payment Card Industry Data Security Standard. It’s a set of security rules created by the major card brands (Visa, Mastercard, American Express, Discover, and JCB). It isn’t a government law. Your agreement with your card processor or bank requires you to follow it.

If your business accepts card payments in any way, PCI applies to you. Size doesn’t change that. A five-person team taking a few payments a week has the same basic duty to protect card data as a large call center. What changes with size is how much paperwork you file to prove it.

The current version is PCI DSS v4.0.1. Every requirement in it, including the newer ones that phased in over several years, has been mandatory since March 31, 2025.

Why phone payments are a special risk

When a customer reads a card number out loud, it can end up in several places you may not think about:

• Call recordings. If you record calls for quality or training, the card number and security code are now stored in your recording system.
• Agent screens. The agent types the number into a payment page, a CRM, or a notes field.
• Paper. An agent jots the number on a sticky note “just for a second.”
• Chat logs and transcripts. AI transcription and call summary tools can capture spoken card numbers as text.
• People. Anyone who can hear the call, including other agents nearby, has access to the number.

Each of these places becomes part of what PCI calls your cardholder data environment. The bigger that environment is, the more systems you have to secure, test, and document.

The one rule you cannot break

PCI treats the security code (the 3 or 4 digits on the back or front of the card, also called the CVV or CVC) as sensitive authentication data. You may use it to approve the payment. You must never store it afterward, in any form, even encrypted.

That means a call recording that captures a customer reading their security code breaks the rules, whether or not anyone ever listens to it. This is the most common PCI problem in contact centers.

Five ways to take phone payments safely

Here they are in order, from the approach that leaves the most card data in your hands to the one that leaves the least.

1. Pause and resume recording

The agent pauses the recording when the customer starts reading card details and turns it back on afterward. Some systems can do this automatically when the agent opens the payment screen.

• Good: Cheap and easy to start.
• Watch out: If an agent forgets to pause, the card data is recorded. Manual pausing relies on people getting it right every time. The agent still hears and types the card number, so the agent’s desktop and the payment system are still in scope.

2. Keypad entry with tone masking (DTMF masking)

The customer types their card number on their phone keypad instead of saying it out loud. The system hides or flattens the beeps so the agent hears only a neutral tone. The numbers go straight to the payment processor. The agent stays on the line to help and sees only a “card accepted” message.

• Good: The agent never hears or sees the card number. Recordings stay clean. The conversation doesn’t stop.
• Watch out: You’ll need a vendor or a phone system feature that supports it. Some customers will need a little coaching the first time.

3. Transfer to a secure IVR

The agent transfers the caller to an automated payment line. The caller enters the card number on the keypad, then is transferred back or the call ends.

• Good: Card data skips your agents and your recordings.
• Watch out: Some callers hang up during the transfer. It also feels less personal than staying with an agent.

4. Send a payment link

The agent sends a secure payment link by text or email while the customer is on the phone. The customer pays on their own device, on a page run by your payment processor.

• Good: Simple, familiar to most customers, and keeps card data off your systems.
• Watch out: It only works if the customer can use a smartphone or email during the call. Make sure links come from a recognizable number or address so they don’t look like a scam.

5. Hand off the full payment process

Some businesses send all phone payments to an outside provider that handles the entire transaction.

• Good: Can greatly reduce what you’re responsible for.
• Watch out: You’re still responsible for choosing a provider that is PCI compliant. Ask for their Attestation of Compliance (AOC) every year.

The general rule: The less card data your people and systems touch, the less you have to protect, and the easier it is to show you’re compliant. People in the industry call this descoping.

Everyday habits that matter

Technology does much of the work, but day-to-day behavior still counts.

• No writing card numbers down. Not on paper, not in notes fields, not in email.
• Never ask customers to send card details by email, text, or chat. If one does, delete it and use a safe method instead.
• Keep cell phones away from payment work if agents could photograph screens.
• Lock screens whenever an agent steps away.
• Limit access. Only staff who take payments should be able to reach the payment system. PCI v4.0.1 requires multi-factor login (a password plus a code or app) for access to systems that handle card data.
• Check your AI tools. If you use transcription, call summaries, or speech analytics, confirm that they redact card numbers automatically.
• Train every year, and include phone scams and social engineering in that training.

How you prove you’re compliant

Most small and mid-sized businesses prove compliance by filling out a Self-Assessment Questionnaire (SAQ) once a year. Your card processor will tell you which form to use. The answer depends on how many card transactions you process and how you handle the card data.

The method you choose above matters a lot here. A business that takes card numbers verbally and types them into its own systems may face hundreds of questions. A business that uses keypad masking or a payment link, where card data never touches its systems, may have a much shorter form.

Larger merchants may need an outside assessor, called a Qualified Security Assessor (QSA). Your processor will tell you if that applies to you.

What happens if you get it wrong

The PCI Security Standards Council doesn’t issue fines itself. Your card processor or bank can, though. Penalties can include:

• Monthly non-compliance fees
• Fines and costs passed down from the card brands after a breach
• The cost of a forensic investigation
• Loss of the ability to accept cards

A breach also means notifying customers under state data breach laws, plus the damage to your reputation. For a small business, that can cost far more than doing it right from the start.

A simple starting checklist

1. List every way your business takes card payments by phone.
2. Listen to a sample of call recordings. Do any of them capture card numbers or security codes?
3. Look at where agents type card data, and check notes fields for stored numbers.
4. Choose a safer method: tone masking, IVR, or payment links.
5. Ask your processor which SAQ you should complete.
6. Collect current Attestations of Compliance from every vendor that touches card data.
7. Train your team, and write down the steps you follow.

Questions to ask vendors

• Does your system keep card numbers off our agents’ screens and out of our recordings?
• Do you support keypad entry with tone masking?
• Can you send us your current PCI Attestation of Compliance?
• Do your transcription or AI features automatically redact card numbers?
• What do we stay responsible for, and what do you cover?

This guide is general information, not legal or compliance advice. PCI requirements depend on your processor agreement and how you handle card data. For your specific situation, check with your card processor or a Qualified Security Assessor.