PCI DSS

PCI DSS is maintained by the PCI Security Standards Council and enforced through the card brands and your payment processor. It covers networks, systems, access, logging and policy. Phone payments are a special case: a card number spoken on a recorded line puts the recording, the transcript and the agent inside the scope of the standard.

Growing businesses meet this when they add call recording, an AI voice agent or a cloud phone system without thinking about the finance desk. The Council's guidance on telephone-based payments describes approaches such as pausing recording during card entry or letting callers key the number so staff and recordings never hear it.

Ask a vendor whether recording can be paused or masked during payment, whether the AI agent refuses to accept card numbers or hands the caller to a compliant payment flow, how any card data is encrypted, and which parts of PCI scope their service takes on. Agree the answers in writing with your processor and advisor.