News for the Hospitality Executive
Violate PCI Security Rules?
According to Don Bundock, CEO of Quality Track International, recording calls with credit card numbers and other sensitive information is certainly a PCI compliance issue.
“Every day, hotel call centers record thousands of agent/customer conversations that contain sensitive credit card information.” says Bundock. “Some call recording systems provide encryption to secure the audio files. But the security resulting from encryption vanishes when play-back for training purposes is initiated as the entire, unmasked credit card number is audible to the user, and anyone else within earshot.”
Recognizing the challenge of removing credit card numbers from audio files, the PCI Security Standards Council has made a temporary exception for audio recordings. However, that exception is based on there being no commercially reasonable technology to delete the card information and states that if removal becomes possible, the card numbers should be deleted.
Quality Track International has developed a process that effectively and economically removes card numbers from audio files. The system has been installed in beta locations and excellent results have been obtained.
“The performance has been very impressive” says Bundock, “We have processed thousands of recordings of hotel reservations and each one has been manually reviewed to determine if the number removal was successful. In every recording, the card number was obscured sufficiently to comply with current PCI DSS requirements.”
One of the challenges in removing card data from the recording of a reservation call is that the card numbers are spoken in many different ways and repeated during the confirmation of the reservation. Processes that rely on keyword triggers often fail to remove all instances of the card number. Systems that allow the agent to mute the recording are susceptible to agent error or fraud and can miss multiple occurrences of the numbers.
The Quality Track proprietary methodology isolates and removes card numbers while leaving important information like rates, confirmation numbers and phone numbers untouched. The card number removal process can be configured to operate on existing call recording systems. Patents are pending.
Testing and refinements are continuing and it is anticipated that a commercial product will be ready for release by the 4th quarter 2008.
About Quality Track International: Founded in 1997 Quality Track International provides call recording and agent performance grading services for call centers and mystery shopping services for the hospitality industry worldwide. For more information contact Don Bundock at Don.Bundock@QualityTrack.com
Quality Track International