TL; DR - Yes, but it is advisable to stay on the right side of the law, as regulations like PCI DSS prohibit contact centres from taking, storing, and sharing specific kinds of payment data.
Card payments are now a staple for organisations, and many customers will refuse to do business with you unless you support card payments. In the wake of the COVID-19 pandemic, card-based payments are now central to small, mid-sized and large businesses alike. And if you can do it telephonically, without having the customer visit a physical store, even better.
It is estimated that by 2016, more than 1 million merchants accepted card payments over the phone.
But here, you might run into a crucial question – how safe are card payments when the details are exchanged telephonically? Are there specific regulatory norms to remember? Here’s what you need to remember.
Understanding PCI DSS as it Pertains to Telephonic Payments
The Payment Card Industry Data Security Standard or PCI DSS is an information security standard that requires organisations and their contact centres to protect cardholder data and manage vulnerabilities among other things. Your exact compliance requirements will depend on the volume of transactions processed annually – < 20k, 20k-1 million, 1 million-6 million, or 6 million+. But no matter which bucket a business is in, you need to restrict the data exchanged via telephone when accepting payment requests.
Data leaks or breaches due to information that was unnecessarily stored will count as non-compliance with PCI DSS.