Card Payments Over the Phone: A Guide to PCI Compliance for UK Businesses

Taking card payments over the phone is quick, convenient and, for many businesses, an important part of delivering good customer service. But whenever a customer shares their card details during a call, your business also takes on responsibility for protecting that sensitive payment information.

That is where PCI compliance comes in. If your organisation accepts, processes, stores or transmits payment card data, the Payment Card Industry Data Security Standard (PCI DSS) is designed to help keep that information secure.

For businesses accepting card payments during customer calls, PCI DSS compliance deserves particular attention. Call recordings, employee access and the systems used to process payments can all affect your PCI DSS scope.

The good news? With the right technology and processes, businesses can continue taking convenient telephone payments while reducing the exposure of sensitive customer card information.

What are the risks of taking card payments over the phone?

Taking payments by phone is common across a wide range of sectors.

A hotel might take a deposit for a booking. A property management company could collect a payment from a tenant. A professional services firm may accept invoice payments, while a busy customer service team could process hundreds of telephone transactions.

The challenge comes when customers provide their card details verbally.

If those details enter your telephone, recording or IT environment, you need to understand where that payment data is going, who has access to it and whether any of it is being stored.

This becomes particularly important when calls are recorded.

PCI DSS prohibits businesses from storing sensitive authentication data such as card verification codes (CVV, CVC or CID) after a transaction has been authorised. Where this information is collected during a recorded call, organisations should make every effort to prevent it from being captured in the recording.

That means businesses taking card payments over the phone need to consider payment security as part of their wider communications infrastructure.

What is PCI compliance?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a global security standard designed to protect payment account data and reduce the risk of payment card fraud.

PCI DSS applies wherever payment card account data is stored, processed or transmitted. That can include organisations accepting payments online, in person and over the telephone.

The current standard is PCI DSS v4.0.1. Requirements that were initially introduced as future-dated requirements became effective on 31 March 2025, meaning organisations assessing against the standard now need to consider applicable requirements as part of their PCI DSS assessment.

PCI compliance therefore should not be viewed as a one-off exercise. Businesses need processes and technology that continue to protect payment information as their operations, workforce and payment methods evolve.

Card payments over the phone and call recording

Call recording has become invaluable for modern organisations.

Recordings can support employee training, quality management, dispute resolution and customer service. Yellowcom’s iPECS communications ecosystem, for example, can provide businesses with call recording alongside reporting and management capabilities.

But payment information requires additional care.

When a customer reads card information aloud, a conventional recording system could potentially capture it alongside the rest of the conversation.

PCI Security Standards Council guidance states that where sensitive authentication data is collected during a telephone call, every effort should be made to prevent that information from being recorded. Technology that suppresses or redacts audio during payment data entry should therefore be enabled where available.

A better approach is to design the payment process so sensitive card information does not become part of the recording in the first place.

How can businesses take secure card payments over the phone?

For businesses using iPECS Cloud, PCI for iPECS is designed to make secure telephone card payments easier to manage.

When a member of your team needs to take payment, card information is entered securely and sensitive information is kept out of the call recording. The Yellowcom reference solution is provided by a Tier-1 PCI accredited service provider and is designed to reduce the compliance burden associated with telephone payments.

This allows organisations to maintain the benefits of call recording without unnecessarily capturing sensitive payment details.

For employees, it also creates a straightforward payment experience without requiring them to handle or retain customer card information themselves.

The benefits of secure card payments over the phone

Protect sensitive customer card information

Customer trust can disappear quickly when sensitive information is mishandled.

A secure telephone payment process helps prevent card details from being unnecessarily exposed to employees or stored in call recordings.

That provides an important additional layer of protection for both your customers and your organisation.

Reduce the PCI DSS scope of your telephone environment

One of the challenges of PCI DSS compliance is understanding all the systems, people and processes that interact with payment card information.

PCI DSS applies to VoIP traffic containing payment card account data once that traffic enters infrastructure controlled by the organisation.

Reducing the amount of card information entering your wider communications environment can therefore make managing risk and compliance more straightforward.

Your exact PCI DSS scope and validation requirements will depend on your environment and payment processes, so these should always be confirmed with the appropriate PCI DSS adviser, acquirer or payment provider.

Continue recording valuable customer conversations

Stopping call recording entirely is not necessarily an attractive option.

Businesses increasingly use recordings to monitor customer experience, coach employees and understand how teams are performing.

The iPECS ecosystem can provide call recording and analytics capabilities that give managers greater visibility of customer interactions. With an appropriate PCI payment solution, businesses can maintain valuable call-management functionality while protecting payment information during transactions.

Give employees a simpler payment process

Taking card payments over the phone securely should not make every customer transaction unnecessarily complicated.

PCI for iPECS is designed to provide an intuitive process that employees can quickly adopt, reducing the need for complicated workarounds when customers want to make a payment.

A simpler process can also reduce the temptation for employees to use insecure alternatives such as manually writing down card details.

Build greater customer confidence

Customers expect organisations to take the security of their financial information seriously.

Having a secure, consistent process for telephone payments can help employees confidently explain how payment information is handled.

That is particularly valuable for sectors where trust is central to the customer relationship, including legal services, healthcare, hospitality, education, property management and professional services.

Is PCI DSS a legal requirement in the UK?

There is an important distinction here.

PCI DSS is an industry security standard rather than a UK law in itself. Compliance obligations are generally imposed through the payment card ecosystem, including payment brands, acquiring banks and contractual arrangements.

Businesses should therefore avoid treating “PCI compliant” and “legally compliant” as interchangeable terms.

Organisations processing personal information may also have separate obligations under UK data protection law. Meeting PCI DSS requirements does not automatically mean every other regulatory or data protection obligation has been satisfied.

For specific compliance requirements, businesses should seek guidance from their acquiring bank, payment service provider or qualified PCI DSS specialist.

What about card payments over the phone for remote and mobile teams?

Hybrid working, distributed customer service teams and mobile employees have changed the way business calls are handled.

A payment process that is secure at a desk in the office also needs to remain secure when employees are working elsewhere.

Yellowcom can help businesses build a more connected iPECS environment around these changing working patterns.

For example, iPECS business phone systems can provide a flexible foundation for business communications, helping organisations connect employees across multiple locations.

The important point is that payment security should form part of your wider communications strategy rather than being considered only after a new phone system has been deployed.

Card payments over the phone: a practical security checklist

If your organisation accepts telephone card payments, start by reviewing how information currently moves through your business.

Consider these questions:

• Do customers provide card information verbally over the phone?
• Are those calls recorded?
• Could card details or security codes appear in recordings?
• Can employees see or write down payment card information?
• Which telephone, network and payment systems handle that data?
• Who has access to recordings containing customer information?
• Do remote or mobile employees ever accept telephone payments?
• Is stored cardholder information retained only for a genuine business, legal or regulatory requirement?
• Do you securely dispose of cardholder data when it is no longer required?
• Have your current PCI DSS validation requirements been confirmed with your payment provider or acquirer?

These questions can help expose areas where payment information is unnecessarily entering your systems or being retained.

Make card payments over the phone safer with Yellowcom

Taking card payments over the phone does not have to mean abandoning call recording or creating a complicated payment experience for customers and employees.

With the right processes and technology, businesses can continue giving customers a convenient way to pay while reducing the exposure of sensitive card information.

PCI for iPECS helps organisations using iPECS Cloud take secure card payments over the phone while keeping sensitive card details out of call recordings and away from employees. The solution is designed to make maintaining PCI compliance easier while providing businesses with predictable monthly expenditure.

And because Yellowcom can support the wider business phone system around it, your organisation can take a more joined-up approach to communications, customer experience and payment security.

If your business currently accepts card payments over the phone, now is a good time to review whether your communications environment is helping or complicating your PCI DSS responsibilities.

Talk to Yellowcom about secure card payments over the phone.