Pause and Resume Is Dead

Syntec recently ran a webinar about PCI DSS in call centres and asked the attendees what they were doing about PCI compliance for ‘card not present’ (CNP) phone payments.

27% said they were using ‘pause and resume call recording’ (also known as ‘stop/start’) to avoid capturing credit and debit card numbers, either agent-operated or as an automated system. 22% said they were not compliant at all, whilst 42% said they did not take payments over the phone (but presumably wanted to, as this was the subject of the webinar).

From this you might conclude that the 27% of merchants who said they were using pause and resume in their contact centres were already PCI compliant.

But you’d almost certainly be wrong.

When companies like Syntec are asked to help merchants’ IT managers and operations managers with this issue of PCI compliance for MOTO phone payments (mail order/telephone order), they often tell them that they have been (mis)sold pause and resume to ‘make them PCI compliant’. For this is only half true at best, as it ignores a number of other key compliance issues in the contact centre as I’ll discuss below.

It’s only one part of a complicated set of PCI DSS compliance requirements

Pause and resume will not in fact make your contact centre compliant. It will (if used correctly) avoid capturing the card numbers, and in particular the sensitive authentication data (SAD) which the PCI DSS regulations say must not be stored (the security number or CV2/CVV), thus making your call recordings PCI compliant.

But the bulk of the hundreds of PCI DSS controls relevant to the contact centre are still not tackled, including those relevant to your agents, their PCs, screen recordings and your network, which are still exposed to the card numbers even if you are using pause and resume.

So, for instance, if your agents are minded to misuse the card data for any reason, they still can; or if you are using unencrypted internet telephony (VOiP) you still remain wide open to hackers listening in and compromising your customers’ card details.

In short, you are not doing enough to tackle PCI DSS compliance holistically in the entire contact centre environment, if you are only introducing pause and resume.

It doesn’t sit well with your customer service or other regulatory requirements

You probably introduced call recordings for monitoring, quality control, training and customer service purposes originally and not with any thought for PCI DSS regulations. For those selling financial services it can also be a regulatory requirement to have full-length recordings for customer complaint resolution.

So this poses two problems, if you introduce the ability to truncate those call recordings. Firstly, you no longer have a recording of the complete call to go through with the staff member concerned or to deal with any customer issues if needs be. This undermines the purpose of having the call recordings in the first place. Secondly, this may also place you in conflict with other regulations.

Agents can misuse pause and resume

Syntec’s own independent annual research survey of a representative sample of consumers indicates that nearly 70% in the UK (and nearly 80% in the USA & Australia) believe that contact centre agents ‘may commit fraud either directly or indirectly by stealing personal data and credit card details’, having been alerted to this danger by constant media reports of such breaches.

The UK’s independent fraud prevention service Cifas backs up this notion in saying that: “32% of internal fraud cases reported by members were committed in contact centres, with many of these offences involving staff disclosing customer or commercial data to organised criminal third parties.”

There’s little to stop any mischievous agent abusing the ‘pause’ in a pause and resume system to get the information they want in the way they want it from the customer, with no recorded evidence to catch them, if there is no full-length recording of every call to listen to after the event.

If it sometimes doesn’t work, it’s not fit for purpose at all

More often than not, though, it’s simply agent error or system malfunction that causes problems with pause and resume systems (so frequently in fact, that Syntec are often told by large merchants that they’ve had to turn theirs off).

If such a system does go wrong, there may not be a pause when the agent is taking the card numbers from the customer, so the numbers are captured in the recording after all, and you then have the headache of not knowing which recordings have card data in them and which don’t.

So, you can’t even go back and cleanse the legacy data from those recordings, and your call recordings are by definition no longer PCI compliant, rendering the system useless.

It solves the wrong problem anyway

The main problem with pause and resume, though, is that it does not address the key issue of customer trust on which the relationship with them (and thus your brand) depends.

The reality is that consumers don’t like reading their card numbers out over the phone in the first place, which pause and resume doesn’t even begin to address. In fact, only 1% to 5% of consumers (depending on country) think that ‘making telephone payments to call centres is secure’, according to Syntec’s research report – and their clear preference is for ‘technology to keep the card data away from agents altogether’ (between 49% and 60%).

So not only is pause and resume only one part of the larger contact centre compliance puzzle, it doesn’t begin to address consumers’ fundamental concerns about lack of security in contact centres anyway, which is a commercial problem far beyond PCI DSS regulations.

Syntec’s research reinforces that consumers are now even becoming reluctant to conclude the transaction if they have to read out their card numbers, with 36% in the UK (53% in the USA and 44% in Australia) saying: “There have been several occasions in the past year when I have not bought something due to being worried about the security of my payment card or ID details when buying over the phone.”

Consumers prefer a new technology solution

The new solution which consumers prefer by a factor of more than 2:1 over pause and resume (in all countries Syntec researched) is DTMF (dual tone multi frequency) payment technology, where the consumer enters their card numbers using the touchtone keypad of their own phone.

There is little difference in this preference between doing this mid-call during the usual callflow with the agent or using it in combination with the merchant’s customer self-service IVR system – the key thing is, they no longer have to read their card numbers out loud.

Long live DTMF!

So for the merchant, this last revelation is doubly important because not only does a DTMF payment solution, such as Syntec’s proprietary CardEasy “keypad payment by phone” system, resolve this overriding issue of customer trust, it stops the sensitive card numbers from entering your contact centre at all, so the numbers are no longer visible to agents or audible to them or to call recordings – which means call recordings can now become full length again and your pause and resume system can finally be ‘retired’.

A DTMF suppression (or masking) system such as CardEasy will resolve nearly all of the PCI DSS controls in the contact centre, descoping your contact centre environment and saving you the time, cost and hassle of PCI monitoring (and audits).

Also, it results in shorter call handling times (AHT) and less mis-keying, as the agent no longer has to take the card numbers down, read them back and then key them in, effectively reducing two procedures down to one and avoiding any mistakes they might make in the process.

Which is why DTMF is becoming the new standard for payments in contact centres, for customer customer experience and trust; for PCI DSS resolution; and for hard-nosed commercial reasons. And it is why pause and resume is dead.

Author: Rachael Trickey