What’s The Rush For New PCI Call Center Requirements?
Written by Walter ConwayFebruary 2nd, 2010
PCI Columnist Walt Conway initially thought the PCI Council’s revised guidance on audio recordings were not that big a deal. He quickly changed his mind.
"You will need to reconfigure your call center application to stop recording the security codes. This point is where I start to have some problems. If your application can’t do this, you need to upgrade or replace it with one that automatically interrupts recording when, for example, the payment screen is displayed. And forget about using manual interrupts, at least if I’m your QSA. In practice, they can be too easily missed, forgotten or ignored. Large retailers will make a business decision and budget for the investment. But what about smaller merchants, charities and universities with call centers?"
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
8 Comments | Read What’s The Rush For New PCI Call Center Requirements?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Ed
February 3rd, 2010 at 7:59 pm
You hit the nail right in the head !
PCI council has made a one-sided decision; They should have done a much more in-depth research that could have provided more insight on what regards to the implications of such decision.
This is a good read, enjoy !
February 4th, 2010 at 6:35 am
The issue in Financial services especially here in the UK is that the regulator here mandates that all call recordings have to kept for at least three years (you can argue for 7) and cannot be altered in any way so deleting the CV2 is prohibited.
This “clarification” is causing a lot of panic with large FS clients who now appear to be non-compliant after spending 7 figure sums on their compliance programs.
The only alternative to call recording would now appear to be some sort of IVR/push button type interrupt to take card data away from the contact centre. The council is a position to force that sort of process and technology change and this may backfire on them and the vendors that lobbied hard for this clarification.
February 4th, 2010 at 11:25 am
Another ridiculous decision where regulators don’t think critically enough about the unintended consequences of their decision. This is why regulation has completely gone off the deep end. Somebody has to make it stop.
This will be a huge problem for the credit and collections industry. We have to keep all recorded calls for other reasons not related to cc information. We can’t purge all of our calls and we don’t have the technology to not record part of the conversation. Even if we did, I am not sure we could afford it.
Another regulatory body and decision that is killing private business. This bs makes me sick to my stomach.
February 4th, 2010 at 1:00 pm
And I have not heard anyone mention the impact on companies who provide quality improvement services. Many merchants hire quality improvement companies to review their audio recordings to provide guidance on how to improve their sales staff’s effectiveness in customer service and sales retention. Many companies have contracts with these types of industries. How do you deal with that type of issue? PCI Council needs to rethink this requirement until there is a widely available commercially viable solution.
February 4th, 2010 at 6:50 pm
Did the PCI SSC intentionally make a 2010 New Year’s resolution to step up efforts to demonstrate how out of touch and inane PCI DSS truly is?
February 5th, 2010 at 4:21 pm
Thanks for all the comments!
@J-R: Sovereign law trumps PCI, so I think your UK regulator’s/government body’s position on recordings will override this PCI guidance. It will be interesting to see if there is some country-specific clarification although this should not be needed. You mentioned using a push-button or some other manual interrupt to avoid recording the security codes. As I noted in the column, I am not convinced this will work given how easy it is to forget/defeat it, but in your case it may be the only viable option.
@Geoff and Mike: Good comments. I forgot about all the related services retailers use who will be affected.
@Cranston: You and I may disagree about the value of PCI, but I take your point that this revised call center guidance may cast a negative light on the whole PCI Council and the Standard for some people. I know some of the Council staff, and they are intelligent, thoughtful, capable people. I am hoping they see that there are some unforeseen difficulties with this latest guidance, and that they consider revising it.
February 5th, 2010 at 6:20 pm
@walt
While specific individuals on the council may indeed be “thoughtful, intelligent, capable people” the council as an entity certainly does not display those qualifications.
If this was a local, back-country, small village bylaw council, I’d be willing to give them a lot more leeway.
But let’s get real here! These people are supposedly the “experts”, the cream-of-the-crop representing billion dollar card companies — and they come up with inane stuff like this?
Don’t blame “some people” for seeing the Council in a negative — put the onus and responsibility where it belongs, on the Council for making such bad decisions. THEY are the ones causing the “negative light”, not those who call them on it.
May 26th, 2010 at 11:15 pm
There might be some problem implementing those new guidelines in some call center companies. Thanks for providing this informative post.