Ibrahim Kosdere Components

Channel Pci

Call Recording, PCI DSS & the Pitfalls

Many organisations that use voice recordings within the Contact Centre do so because it is required for business reasons, such as agent training or confirmation of verbal contractual agreements that are carried out over the telephone channel when selling services.

Depending upon the transaction type, regulatory requirements to keep any recordings (for varying periods of time) for playback apply. For businesses, particularly in the financial services and retail sectors, further requirements apply due to the fact that when purchase transactions are completed over the telephone using payment cards, certain data needs to be protected.

For organisations that are required to record telephone conversations and also take payment card details over the phone the recording and storage of this data can become a PCI compliance issue.

Typically the call recording will record the whole conversation including the Primary Account Number (PAN) and the three or four digit security code (CAV2, CVC2, CVV2 or CID). In addition to the considerations required around the call recordings, enhanced processes and procedures are required for all of other stages involved in and around the initial call.

There are many things to be considered when recording a call containing cardholder data, it is vital to quickly determine what data needs to be protected, for what length of time and depending upon what analytical tooling is in place within your business; the appropriate management and protection of this information is paramount. It is worth noting that some of the largest fraudulent activities that occur are often from within the organisation, so it is imperative to ensure that voice recording is looked at from both a technology and a user process perspective, as they go hand in hand.

Some things to consider

1. Is a formal Security Awareness Training programme in place and being maintained?
2. Have you developed and implemented a set of PCI DSS compliant Policies?
3. Are the call recordings stored securely?
4. Is your network securely maintained and protected against attack?
5. Do you maintain and secure a detailed set of auditable logs?

Where technology exists to prevent recording of these data elements, such technology should be enabled. If these recordings cannot be data mined, storage of CAV2, CVC2, CVV2 or CID codes after authorisation may be permissible as long as appropriate validation has been performed. This includes the physical and logical protections defined in PCI DSS that must still be applied to these call recording formats.

What this means:

Essentially, the Card Verification Value (CVV) must not be retained post authorisation. In any event, and only as a last resort, where a CVV is retained it must be held subject to additional security controls to meet the intent of the Standard, but always via a compensating control.

Before any such compensation control can be implemented it must be verified by a Qualified Security Assessor (QSA) in turn approval must be obtained for the compensation control from the acquiring bank.

How can Sysnet help you?

Sysnet Global Solutions is a QSA providing a range of services and solutions that enable organisations to become and remain compliant with the standard. We have developed tailored packages to address the specific requirements of organisations who must comply with the requirements discussed in this document.

For further information on our Information Security Services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

Alternatively, for a full list of contact details for our worldwide offices and Business Development Managers, please click here.

About the Author

Siig IC400012S1 SoundWave 4 Channel PCI $33.1 SoundWave 4 Channel PCI DP SoundWave 4 Channel PCI

SIIG INC / SOUNDWAVE PCI 4 CHANNEL / IC-400012-S1 $29.89 SIIG INC - SOUNDWAVE PCI 4 CHANNEL - IC-400012-S1

EMULEX I/O PCI CHANNEL NIC FC1010439-02REVB $78.97 EMULEX I/O PCI CHANNEL NIC FC1010439-02REVB

Emulex 32bit PCI Fiber Channel Adapter FC101042802 $229.3 Emulex 32bit PCI Fiber Channel Adapter FC101042802

Emulex PCI Fibre Channel Adapter FC101044102 $229.3 Emulex PCI Fibre Channel Adapter FC101044102

SUN Dual Channel SCSI Controller PCI X6541A $12.03 SUN Dual Channel SCSI Controller PCI X6541A

SUN Dual Channel SCSI Controller PCI 375-0006 $12.03 SUN Dual Channel SCSI Controller PCI 375-0006

IBM Dual Channel SCSI Controller PCI 19P0530 $16.03 IBM Dual Channel SCSI Controller PCI 19P0530

SIIG DP SOUNDWAVE 4 CHANNEL PCI IC400011A1 $64.47 SIIG DP SOUNDWAVE 4 CHANNEL PCI IC400011A1

Dell Dual Channel SCSI Controller PCI 348-0040866A $14.03 Dell Dual Channel SCSI Controller PCI 348-0040866A

Fujitsu Siemens Zero-Channel Storage Controller (zero-channel RAID) 0 Channel PCI-X S26361F3085L128 $74.23 Fujitsu Siemens Zero-Channel Storage Controller (zero-channel RAID) 0 Channel PCI-X S26361F3085L128

Adaptec GigE NAC 7711F PCI Fiber Channel Interface 1975600 $190 Adaptec GigE NAC 7711F PCI Fiber Channel Interface 1975600

Emulex LightPulse LP982-E Network Adapter PCI-X Fibre Channel LP982E $355 Emulex LightPulse LP982-E Network Adapter PCI-X Fibre Channel LP982E

HP Fiber Channel 64 bit PCI Host Bus Adapter $111.2 HP Fiber Channel 64 bit PCI Host Bus Adapter

NetApp LSI Logic 4GB Fibre Channel PCI Express 4-Ports X2054B $1200 NetApp LSI Logic 4GB Fibre Channel PCI Express 4-Ports X2054B

Dell 4GB/S Fiber Channel PCI-E HBA CD621 $167.79 Dell 4GB/S Fiber Channel PCI-E HBA CD621

IBM 4GB Fibre Channel PCI-X Host BUS Adapter 39M6018 $87.8 IBM 4GB Fibre Channel PCI-X Host BUS Adapter 39M6018

IBM 4GB PCI-Express Dual-Port Fibre Channel Adapter 5774 $982.7 IBM 4GB PCI-Express Dual-Port Fibre Channel Adapter 5774

QLogic Infiniband 4x DDR To PCI Express Host Channel Adapter QLE7240 $124.07 QLogic Infiniband 4x DDR To PCI Express Host Channel Adapter QLE7240

IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8736 $270.13 IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8736

IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8738 $275.13 IBM Dual Channel PCI X DDR Ultra320 SCSI Adapter 42R8738

Emulex Network Adapter PCI 64 Fibre Channel 1-Port Bulk LP8000T1 $341.62 Emulex Network Adapter PCI 64 Fibre Channel 1-Port Bulk LP8000T1

Emulex LightPulse Network Adapter PCI Fibre Channel LP7000ET1 $159.1 Emulex LightPulse Network Adapter PCI Fibre Channel LP7000ET1

Emulex LightPulse Network Adapter PCI Fibre Channel Bulk LP7000E $150.52 Emulex LightPulse Network Adapter PCI Fibre Channel Bulk LP7000E

HP StorageWorks 32bit/33MHz PCI-to-Fibre Channel Host BUS Adapter 380574 $160.65 HP StorageWorks 32bit/33MHz PCI-to-Fibre Channel Host BUS Adapter 380574

Emulex LightPulse Network Adapter PCI-X Fibre Channel LP1050DCE $39.06 Emulex LightPulse Network Adapter PCI-X Fibre Channel LP1050DCE

QLogic 4GB Fibre Channel to PCI Express HBA QLE200 $148.5 QLogic 4GB Fibre Channel to PCI Express HBA QLE200

Emulex LightPulse Network Adapter PCI-X Fibre Channel LP9802F2 $36.26 Emulex LightPulse Network Adapter PCI-X Fibre Channel LP9802F2

Emulex Fibre Channel 2Gbps Fiber PCI-X LP10000M2 $23.1 Emulex Fibre Channel 2Gbps Fiber PCI-X LP10000M2

Emulex LightPulse Network Adapter Fibre Channel PCI-X 2-Ports LP11002E $118.86 Emulex LightPulse Network Adapter Fibre Channel PCI-X 2-Ports LP11002E

Emulex 4GB/S Fiber Channel PCI-E 2-Ports HBA LPE11002E $346.86 Emulex 4GB/S Fiber Channel PCI-E 2-Ports HBA LPE11002E

Emulex Fibre Channel 2Gbps Fiber PCI-X LP1050DCF2 $39.06 Emulex Fibre Channel 2Gbps Fiber PCI-X LP1050DCF2

Emulex LP9002DC-E IS A 2GB/s FC-PCI HBA Fibre Channel LP9002DCE $1100 Emulex LP9002DC-E IS A 2GB/s FC-PCI HBA Fibre Channel LP9002DCE

Emulex LP9002L-E 2GB/s Fibre Channel PCI Host BUS Adapter FC102003401J $346.86 Emulex LP9002L-E 2GB/s Fibre Channel PCI Host BUS Adapter FC102003401J

HP StorageWorks FCA2354 Network Adapter PCI 64 Fibre Channel 261329B21 $305 HP StorageWorks FCA2354 Network Adapter PCI 64 Fibre Channel 261329B21

Emulex the LightPulse Fibre Channel PCI Host Adapter LP9002LF2 LP9002L-F2 $11.7 Emulex the LightPulse Fibre Channel PCI Host Adapter LP9002LF2 LP9002L-F2

Emulex Fibre Channel Host BUS Adapter PCI LP8000 $55 Emulex Fibre Channel Host BUS Adapter PCI LP8000

Emulex Network Adapter PCI 64 Fibre Channel 2-Ports LP8000DCF1 $108.9 Emulex Network Adapter PCI 64 Fibre Channel 2-Ports LP8000DCF1

Emulex LightPulse HBA Fibre Channel PCI-Express x4 2-Ports LP10000EXDCM2 $1999.97 Emulex LightPulse HBA Fibre Channel PCI-Express x4 2-Ports LP10000EXDCM2