From Accepting Credit Cards Over the Phone to Virtual Terminals: Ensuring PCI Compliance and Reducing Risks

Having staff accept credit card payments over the phone can be a convenient option for businesses and organizations, but it also brings with it specific security obligations under the Payment Card Industry Data Security Standard (PCI DSS). For organizations that manually enter customer credit card data into a virtual terminal (VT), compliance isn’t just about using a PCI-compliant virtual terminal or PCI compliant card entry application; it begins well before the card information is keyed in. Let’s explore what the PCI DSS requires for handling these transactions, particularly under the Self-Assessment Questionnaire (SAQ) C-VT, and discuss some alternatives that can reduce your PCI compliance burden.

Your Responsibilities Start Before the Virtual Terminal

Even though you may be using a PCI-compliant application to process payments, the moment you accept card details over the phone, your compliance obligations begin. Handling credit card information verbally presents risks, such as:

• Accidental recording or storing of cardholder data, particularly if phone calls are recorded for customer service purposes.
• Human errors or data breaches, where sensitive data may be written down or overheard by unauthorized individuals.
• Device security where the card information is entered, ensuring that the computer or device is protected against malware or unauthorized access.

These factors mean that businesses must enforce strict security controls throughout the process, even before reaching the stage of entering data into a virtual terminal, billing system, or CRM tool.

If your staff accepts and captures credit card information over the phone and enters it into a virtual terminal or payment software interface, you must comply with PCI guidelines and complete the Self-Assessment Questionnaire (SAQ C-VT), where “VT” stands for Virtual Terminal.

Understanding Self-Assessment Questionnaire (SAQ) C-VT: What Does It Cover?

The SAQ C-VT is specifically designed for organizations that process credit card payments using a virtual terminal via a computer connected to the internet. This applies to scenarios where employees manually enter cardholder data into a PCI-compliant virtual terminal provided by a payment processor. In addition, SAQ C-VT also covers situations where staff enter cardholder information through a billing system, CRM, or web-based application that integrates with the payment processor/gateway. These systems allow employees to manually input and process payments through a connected platform. Other SAQ’s may apply depending on who built and manages the application where the credit card in entered.

While the virtual terminal and related applications may be provided by a reputable, PCI-compliant payment processor, it’s important to understand that compliance doesn’t stop there. The responsibility for protecting sensitive cardholder information begins the moment it is collected. Whether your staff is entering data directly into a virtual terminal or using a billing or CRM tool that links to the payment gateway, you are responsible for ensuring that all processes, systems, and handling methods are secure.

According to the PCI SAQ C-VT, your responsibilities include and are not limited to:

1. Card Collection by Staff: Staff can take card details over the phone but must never write them down or store them anywhere once the payment is processed.
2. Card Data Entry into Virtual Terminal: Employees must log in with their own username and password to access the payment system. Additionally, they may need to confirm their identity (like a code sent to their phone). Payments must always be processed on a secure website (look for “https” in the web address).
3. Requirements for the Computing Environment: The computers used for taking payments need up-to-date antivirus software, a firewall, and should only be used for payment processing—no browsing or other activities.
4. Physical Security of the Location: The computers used for entering card details should be in a secure area where only authorized employees have access. Any paper receipts or documents with card details must be securely stored or shredded immediately.
5. Network and Internet Requirements: The internet connection used for payments must be secure. If using Wi-Fi, it should be password-protected and only accessible to authorized staff.
6. Regular Maintenance and Monitoring: Regular updates to software and security checks are required to keep the payment systems safe. Logs of transactions should be checked regularly to spot any unusual activity.
7. Prohibited Practices:

• Staff should never store sensitive card details (like CVV codes) after the payment is completed. Always use secure connections for processing payments and follow company and PCI security policies.

• Never prompt callers to leave their credit card information in your voicemail.

• Calls must never be recorded , especially when the card data is being obtained.