PCI pause and resume is a contact center feature that stops call recording while a customer gives payment card details and restarts it once the payment is complete. The goal is to keep card numbers and security codes out of stored recordings, which reduces the amount of sensitive card data the organization holds under the Payment Card Industry Data Security Standard (PCI DSS). It is one of several approaches to taking payments by phone; others, such as secure IVR and DTMF masking, keep card data away from agents altogether. How any approach affects your compliance scope is decided with your assessor.
At a glance
- Recording pauses while the caller reads out card details, then resumes for the rest of the call.
- Pausing can be manual, by the agent, or automatic, triggered by the payment application or desktop.
- It keeps card data out of recordings, but the agent still hears it, and phones, desktops and networks may remain in scope.
- Secure IVR payment and DTMF masking are common alternatives that also keep card data away from agents.
- Your QSA or acquirer determines how any approach affects your PCI DSS scope; get their view before you choose.
What problem it solves
Contact centers record calls for quality, training, disputes and compliance. But when customers read out card numbers and security codes, those details end up in the recordings. Recordings with card data are sensitive under PCI DSS: storing security codes after authorization is generally prohibited, and every system that holds recordings, every backup and every person with access can be pulled into assessment scope. Scrubbing card data from existing recordings is costly, and new recordings keep adding more.
Pause and resume addresses the source: if the recorder isn’t running during the payment, card data doesn’t end up in the recording. It was one of the earliest and simplest responses to this problem and is still widely available in contact center as a service (CCaaS) and call recording platforms.
How it works
Manual pause and resume. The agent clicks a pause control before asking for card details and resumes recording afterward. It is simple but relies on agents remembering both steps every time; a missed pause records card data, and a missed resume loses the rest of the call.
Automatic pause and resume. The recording platform pauses when a trigger fires, such as the agent opening the payment form in the CRM or payment application, and resumes when the form is submitted or closed. This reduces human error but depends on integration with the systems agents use.
What else needs to pause. Screen recording, real-time transcription, speech analytics and quality management (QM) tools may capture audio or screens independently. Each needs to pause, or card data can still be stored somewhere.
Alternatives that keep data from agents. With secure interactive voice response (IVR) payment, the agent transfers the caller to an automated system to key in card details, then the caller returns. With DTMF masking, the caller types card numbers on the keypad while staying on the line with the agent; the tones are masked so the agent and recording hear only flat tones, and the digits are typically passed directly to the payment processor. These approaches can reduce scope further than pause and resume, depending on how they are deployed and what your assessor accepts.
When it matters for buyers
- When choosing a contact center platform. Pause and resume, secure IVR payment and DTMF masking support vary by vendor and tier.
- When a PCI assessment or compliance deadline approaches. Your assessor will ask how card data is handled on calls and recordings.
- When adding analytics or AI tools. New transcription or analytics tools can capture card data that the recorder no longer does.
- When agents work from home. Remote agents can widen the environment in scope, which may favor approaches that keep card data away from agents.
Questions to ask vendors
- Do you support manual and automatic pause and resume, and what can trigger an automatic pause?
- Do transcription, analytics, screen recording and quality tools pause at the same time?
- Do you offer secure IVR payment or DTMF masking, and at what extra cost?
- Which parts of your platform are covered by your own PCI DSS attestation, and can we see it?
- How do you log pauses and resumes so we can show our assessor they happened?
- How do you find and remove card data from recordings that were captured before pausing was in place?
How it differs from DTMF masking
Pause and resume and DTMF masking both aim to keep card data out of recordings, but they handle the agent differently. With pause and resume, the customer still reads card details aloud and the agent hears or types them, so the agent’s phone, desktop and environment may stay in scope. With DTMF masking, the customer keys the digits on the keypad and the agent hears only masked tones, which is designed to keep card data away from both the recording and the agent. Masking usually costs more and needs integration with a payment processor. Our contact center as a service overview covers how platforms handle secure payments.