Ibrahim Kosdere Components

Channel Pci

Call Recording, PCI DSS & the Pitfalls

Many organisations that use voice recordings within the Contact Centre do so because it is required for business reasons, such as agent training or confirmation of verbal contractual agreements that are carried out over the telephone channel when selling services.

Depending upon the transaction type, regulatory requirements to keep any recordings (for varying periods of time) for playback apply. For businesses, particularly in the financial services and retail sectors, further requirements apply due to the fact that when purchase transactions are completed over the telephone using payment cards, certain data needs to be protected.

For organisations that are required to record telephone conversations and also take payment card details over the phone the recording and storage of this data can become a PCI compliance issue.

Typically the call recording will record the whole conversation including the Primary Account Number (PAN) and the three or four digit security code (CAV2, CVC2, CVV2 or CID). In addition to the considerations required around the call recordings, enhanced processes and procedures are required for all of other stages involved in and around the initial call.

There are many things to be considered when recording a call containing cardholder data, it is vital to quickly determine what data needs to be protected, for what length of time and depending upon what analytical tooling is in place within your business; the appropriate management and protection of this information is paramount. It is worth noting that some of the largest fraudulent activities that occur are often from within the organisation, so it is imperative to ensure that voice recording is looked at from both a technology and a user process perspective, as they go hand in hand.

Some things to consider

1. Is a formal Security Awareness Training programme in place and being maintained?
2. Have you developed and implemented a set of PCI DSS compliant Policies?
3. Are the call recordings stored securely?
4. Is your network securely maintained and protected against attack?
5. Do you maintain and secure a detailed set of auditable logs?

Where technology exists to prevent recording of these data elements, such technology should be enabled. If these recordings cannot be data mined, storage of CAV2, CVC2, CVV2 or CID codes after authorisation may be permissible as long as appropriate validation has been performed. This includes the physical and logical protections defined in PCI DSS that must still be applied to these call recording formats.

What this means:

Essentially, the Card Verification Value (CVV) must not be retained post authorisation. In any event, and only as a last resort, where a CVV is retained it must be held subject to additional security controls to meet the intent of the Standard, but always via a compensating control.

Before any such compensation control can be implemented it must be verified by a Qualified Security Assessor (QSA) in turn approval must be obtained for the compensation control from the acquiring bank.

How can Sysnet help you?

Sysnet Global Solutions is a QSA providing a range of services and solutions that enable organisations to become and remain compliant with the standard. We have developed tailored packages to address the specific requirements of organisations who must comply with the requirements discussed in this document.

For further information on our Information Security Services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

Alternatively, for a full list of contact details for our worldwide offices and Business Development Managers, please click here.

About the Author

SIIG INC / SOUNDWAVE PCI 4 CHANNEL / IC-400012-S1 $29.89 SIIG INC - SOUNDWAVE PCI 4 CHANNEL - IC-400012-S1

EMULEX I/O PCI CHANNEL NIC FC1010439-02REVB $78.97 EMULEX I/O PCI CHANNEL NIC FC1010439-02REVB

Emulex 32bit PCI Fiber Channel Adapter FC101042802 $229.3 Emulex 32bit PCI Fiber Channel Adapter FC101042802

Emulex PCI Fibre Channel Adapter FC101044102 $229.3 Emulex PCI Fibre Channel Adapter FC101044102

Emulex the LightPulse Fibre Channel PCI Adapter LP9002LE $72.85 Emulex the LightPulse Fibre Channel PCI Adapter LP9002LE

Dell Dual Channel SCSI Controller PCI 348-0040866A $9.46 Dell Dual Channel SCSI Controller PCI 348-0040866A

SUN Dual Channel SCSI Controller PCI X6541A $7.48 SUN Dual Channel SCSI Controller PCI X6541A

SUN Dual Channel SCSI Controller PCI 375-0006 $7.48 SUN Dual Channel SCSI Controller PCI 375-0006

IBM Dual Channel SCSI Controller PCI 19P0530 $11.44 IBM Dual Channel SCSI Controller PCI 19P0530

Emulex 8GB/s Fibre Channel Mezzanine Card PCI-E LPE1205 $158.97 Emulex 8GB/s Fibre Channel Mezzanine Card PCI-E LPE1205

Emulex 8GB/s Fibre Channel Mezzanine Card 2-Ports PCI-E LPE1205M $361.56 Emulex 8GB/s Fibre Channel Mezzanine Card 2-Ports PCI-E LPE1205M

SUN Microsystems Network Adapter Pci Fibre Channel X6767A $389.11 SUN Microsystems Network Adapter Pci Fibre Channel X6767A

SUN Microsystems Network Adapter PCI GigaBit EN Fibre Channel X2069A $637.07 SUN Microsystems Network Adapter PCI GigaBit EN Fibre Channel X2069A

SUN Microsystems Expansion Module Pci 64 Fibre Channel 2-Ports X6727A $196.33 SUN Microsystems Expansion Module Pci 64 Fibre Channel 2-Ports X6727A

SUN Microsystems Network Adapter PCI FC-AL Fibre Channel X6799A $141.31 SUN Microsystems Network Adapter PCI FC-AL Fibre Channel X6799A

SUN Microsystems Expansion Module PCI 64 Fibre Channel 2-Ports X6727A $398.32 SUN Microsystems Expansion Module PCI 64 Fibre Channel 2-Ports X6727A

Dell 4GB Fibre Channel To PCI Express HBA QLE220DEL $224.85 Dell 4GB Fibre Channel To PCI Express HBA QLE220DEL

HP Ultra320 SCSI 1 Channel Controller PCI-X 403049001 403049-001 $17.55 HP Ultra320 SCSI 1 Channel Controller PCI-X 403049001 403049-001

HP / Compaq 64bit PCI Fibre Channel Host BUS Adapter Dskgpsacy $24.43 HP / Compaq 64bit PCI Fibre Channel Host BUS Adapter Dskgpsacy

Dell 4GB Fibre Channel To PCI Express HBA DR345 $204.57 Dell 4GB Fibre Channel To PCI Express HBA DR345

HP 64bit PCI Dual Channel Ultra 320 SCSI Controller LSI22320BCS-HP $48.58 HP 64bit PCI Dual Channel Ultra 320 SCSI Controller LSI22320BCS-HP

IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8738 $446.46 IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8738

IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8736 $440.61 IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8736

Compaq/ Emulex Controller Card PCI Fiber Channel Kgpsa-by 401918-001 LP7000T1 $67.85 Compaq/ Emulex Controller Card PCI Fiber Channel Kgpsa-by 401918-001 LP7000T1

HP StorageWorks FCA2404DC Fibre Channel Adapter PCI-X 2Gbps 323264B21 $17.8 HP StorageWorks FCA2404DC Fibre Channel Adapter PCI-X 2Gbps 323264B21

Compaq NC3134 10/100 Dual Channel 64 PCI 138603-B21 161105-001 138603B21 $19.99 Compaq NC3134 10/100 Dual Channel 64 PCI 138603-B21 161105-001 138603B21

Emulex Fibre Channel PCI Host BUS Adapter with GBIC FC102001707B $310.59 Emulex Fibre Channel PCI Host BUS Adapter with GBIC FC102001707B

Emulex Network Adapter PCI Fibre Channel 1-Port Bulk LP7000EN1 LP7000E-N1 $149.97 Emulex Network Adapter PCI Fibre Channel 1-Port Bulk LP7000EN1 LP7000E-N1

Emulex LightPulse Network Adapter PCI 64 Fibre Channel Bulk LP850F1 $341.62 Emulex LightPulse Network Adapter PCI 64 Fibre Channel Bulk LP850F1

Emulex Network Adapter PCI 64 Fibre Channel 1-Port Bulk LP850D1 $165.26 Emulex Network Adapter PCI 64 Fibre Channel 1-Port Bulk LP850D1

Emulex LightPulse 1GB Fibre Channel Controller PCI LP7000EEMC $175.42 Emulex LightPulse 1GB Fibre Channel Controller PCI LP7000EEMC

Emulex LightPulse Network Adapter PCI Fibre Channel Bulk LP6000 $145.88 Emulex LightPulse Network Adapter PCI Fibre Channel Bulk LP6000

Emulex Network Adapter PCI 64 Fibre Channel 1-Port Bulk LP8000T1 $341.62 Emulex Network Adapter PCI 64 Fibre Channel 1-Port Bulk LP8000T1

Emulex LightPulse Network Adapter PCI Fibre Channel LP7000ET1 $159.1 Emulex LightPulse Network Adapter PCI Fibre Channel LP7000ET1

Emulex LightPulse Network Adapter PCI Fibre Channel Bulk LP7000E $150.52 Emulex LightPulse Network Adapter PCI Fibre Channel Bulk LP7000E

HP StorageWorks 32bit/33MHz PCI-to-Fibre Channel Host BUS Adapter 380574 $160.65 HP StorageWorks 32bit/33MHz PCI-to-Fibre Channel Host BUS Adapter 380574

Emulex LightPulse Network Adapter PCI-X Fibre Channel LP1050DCE $39.2 Emulex LightPulse Network Adapter PCI-X Fibre Channel LP1050DCE

Emulex LP9002DC-E IS A 2GB/s FC-PCI HBA Fibre Channel LP9002DCE $1100 Emulex LP9002DC-E IS A 2GB/s FC-PCI HBA Fibre Channel LP9002DCE

Emulex LP9002L-E 2GB/s Fibre Channel PCI Host BUS Adapter FC102003401J $348.36 Emulex LP9002L-E 2GB/s Fibre Channel PCI Host BUS Adapter FC102003401J

HP StorageWorks FCA2354 Network Adapter PCI 64 Fibre Channel 261329B21 $305 HP StorageWorks FCA2354 Network Adapter PCI 64 Fibre Channel 261329B21