When COVID-19 forced contact centres to shut their doors and send their team remote, many of the challenges on their checklists were obvious.
Tasks like ensuring that everyone had the hardware and connectivity to keep taking calls were at the top of everyone’s list. Worrying about maintaining regulatory compliance for industry standards like PCI-DSS was probably lower down as organisations were more concerned about staying in business long enough to be audited later.
At first, the regulators were prepared to grant leniency in enforcing compliance standards. But now after nearly eight months of adjustment leeway, companies are expected to be putting in place safeguards to payment card data that will keep their customers protected from fraud.
For companies handling payment card information, the move to remote work imposes challenges that they simply have not had to contend with in the past.
Furthermore, being able to prove to auditors that they are taking sufficient steps is even more difficult as many of the protective measures that they relied on in the working from office days are far less feasible.
The Challenge of Enforcing PCI-DSS in a Remote Work Reality
Speaking with Kieron Flood, a Client Director at cloud communications provider Olive, he tells UC Today that maintaining compliance standards under PCI-DSS means meeting a checklist of some 263 different points that cover the controls and procedures that businesses take to ensure that their employees are taking the required precautions to keep payment card data safe.
In order to meet these standards, companies have implemented policies that govern how employees are able to access payment card information stored within their systems. This generally means managing authorisations and identities of employees who are allowed to access this valuable information. By tracking who accessed what and creating a “paper trail”, these technology-driven safeguards should deter malicious activity by raising the probability of bad actors getting caught.
However, there is always the human link in the chain that is hard to lockdown. For contact centres that take payment card numbers over the phone, a bad actor could, in theory, always just write the card number down on a piece of paper and sell them on the black market.
In the office setting, companies can more or less keep an eye on employees with trusted supervisors. But in a work-from-home situation, this monitoring becomes downright impossible. And from a regulatory point of view, even harder to document that everyone was on their best behaviour.
“As we try and transition into the working from home environment, the ability to be able to control and prove to the auditors that you have secured the locations which people are working from is very, very difficult,” says Flood, noting that in the home environment, a malicious insider can wreak havoc to a company’s reputation if they engage in fraud.
“The control measures that you have within an office space are becoming less controllable.”
So, given the severity of the risk at hand, how can companies protect their customers and remain compliant in operating their contact centres?
3 Trends Aimed at Improving Customer Security and Experience
In his role working with Olive’s customers on modernising the way that they securely interact with their customers, Flood has noticed a number of trends and key points that are moving the conversation forward.
1 - Taking the Data out of Scope
When it comes to data security in general, the best way to avoid information falling into the wrong hands is to not store it in the first place.
Flood says that some companies are taking basic steps to reduce their exposure by pausing recordings of calls when payment card numbers are taken.
He describes how, “Others are implementing more advanced solutions which allow for the full call to be recorded as the caller enters their card details into their keypad, the DTMF tones are masked so the agent is unable to recognise them. Once the information is captured, the system sends it directly to the card provider for approval, thus descoping the contact centre. Once that approval is given, the agent receives a notification and the transaction can proceed.”
An interesting security feature here that Flood points out is that this system uses a monotone for the keypad to avoid anyone familiar with the different button tones from identifying which numbers are being used.