In this article we look at the importance of Taking Credit Card Payments Over The Phone Regulations. This is essential when businesses accept credit card payments and debit card payments over the phone.
This has become more ever more important in recent years as remote payments grow in popularity. Recent events like COVID-19 accelerated this need, as many in-store transactions became phone transactions. Since then distance or non-present transactions have remained popular by phone or through other remote channels.
When taking card over the phone payments for orders, businesses face higher risks of credit card fraud. So, it’s crucial to secure cardholder data to comply with Payment Card Industry Data Security Standards (PCI DSS). But compliance with PCI DSS is often misunderstood!
Many merchants do not fully understand their responsibilities when handling mail order and telephone order (MOTO) payments. They also may not know their duties for other current card-not-present (CNP) transactions.
Key Recommendations
Some common recommendations for accepting payments over the phone include:
- Get as much information as possible.
- Be alert for unusual details.
- Don’t record the call.
- Never write down card numbers.
- Train all employees in proper procedures and guidelines.
These recommendations are valid but can sometimes be misleading, especially when misunderstood. For example, many people cite the practice of not recording calls as a method to achieve PCI DSS compliance. But the use of pause and resume features during credit card payment processing is not a valid solution.
However, this only represents a small part of what PCI DSS security standards require. Failing to follow comprehensive security measures when taking remote payments can put both your business and customers at risk. This can lead to severe fines and consequences, sometimes even resulting in business closure.
What Are the Taking Credit Card Payments Over The Phone Regulations?
To process card transactions legally, merchants must comply with several payment card industry data regulations. Specifically, regarding payments over the phone, the payment service regulations include:
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a compliance framework that ensures payment processors and merchants handle sensitive credit card information securely. Being PCI DSS compliant shows that a payment service provider (PSP) follows strict rules. These rules protect the privacy and security of payment card data.
Since MOTO payments involve handling cardholder data, PCI DSS is the most relevant security measure for payments over the phone. PCI DSS Level 1 is the highest security standard that a PSP can comply with. Merchants must make sure their payment processors follow these security standards. This helps them avoid fines and penalties for not complying.
GPDR
In addition to PCI DSS, businesses processing cardholder data must comply with the General Data Protection Regulation (GDPR), which applies to the handling of personal information. GDPR defines cardholder data, including credit card information and personal details.
These details can be names, email addresses, and even political opinions. This regulation requires businesses to ensure that they process all data lawfully, fairly, and transparently. Storing only the necessary amount of data for as long as its purpose lasts.
GDPR emphasises data accuracy, security (preferably via encryption), and the ability to demonstrate compliance if investigated. In short, protecting cardholder data is essential when taking credit card payments over the phone.
PSD2
The EU Revised Directive on Payment Services (PSD2) also influences online payment systems and card transactions. One key requirement of PSD2 is Strong Customer Authentication (SCA), which is applicable for customer-initiated payments. However, MOTO payments classify as merchant-initiated, so SCA does not apply in this case.
A notable point is that 3D Secure 2.0, an authentication protocol designed to reduce fraud in online payments, does not apply to MOTO payments at present, though this could change in future revisions.
A point to note – 3D Secure V2 does not apply to MOTO
3D Secure 2.0 is an authentication protocol that aims to reduce fraud and enhance security in online card payments. 3D Secure V2 does not currently apply at present to MOTO payments.
Card-Not-Present Transactions Are Broader Than MOTO
While MOTO payments used to dominate card-not-present (CNP) transactions, the payment card industry has evolved. Today, businesses need to provide different payment options to meet customer needs. These options include email, social media, and web chat.
Although these methods are different, they all belong to card-not-present payments. They must follow industry data security standards, like the PCI DSS.
Each payment channel has its own security threats. This makes it hard for businesses to ensure compliance across different platforms.
Conclusion…
So what is our conclusion on Taking Credit Card Payments Over The Phone Regulations?
Any merchant who takes payments over the phone or online needs a secure payment system. This must comply with relevant regulations such as PCI DSS, GDPR, and PSD2. By following these rules, it reduces the risk of fraud. It also protects the business and the customer’s card information.
No matter the size of a business, it must follow the rules. This applies whether it takes payments over the phone, through web chat, or other remote methods. Compliance is essential for all businesses.
Manually managing the compliance process is nearly impossible, and creating the necessary infrastructure is both expensive and complicated. This is why developers created PayGuard, focusing solely on creating compliant payment technology. Helping merchants achieve PCI DSS compliance while also making their payment processes efficient and flexible.
Take Payments Over the Phone with PayGuard
No matter what industry your organisation is in, you must comply with the rules if you take credit card payments over the phone. At PayGuard, we understand the complexities of card processing and adhering to taking credit card payments over the phone regulations. This includes the PCI DSS and GDPR regulations. We’ve made it our mission to simplify the process for you.
Our PCI DSS compliant phone payment systems make it easy to handle credit card information safely. This lets your team focus on what truly matters, taking care of your customers. Best of all, we offer affordable solutions so even small businesses can benefit from secure, compliant payments.
Learn more about how our over-the-phone payment processing solution can help your business stay compliant and efficient.
