PCI DSS for Call Centres: Phone Payments, Pause-and-Resume and DTMF Masking

Scope-reduction patterns

• DTMF suppression / masking to payment gateway
• Pause-and-resume on recordings during CHD entry
• Browser-isolated virtual terminals
• No CHD in CRM notes (DLP + training)

BPO due diligence

Contracts, visitor controls, CCTV over agent floors, and banned personal mobiles in CHD zones.

Evidence

Configs proving masking, sample redacted recordings tests, and agent training records (Req 12.6).

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Can agents type PAN into CRM?

That usually pulls CRM into CDE — avoid.

Is pause-and-resume enough alone?

Helpful for recordings; still control desktop/network scope.

Offshore BPOs?

Expect stricter brand/acquirer scrutiny — document controls heavily.

Related Resources

• Remote agents
• Security awareness