DTMF Masking The New standard in MOTO Payment Security

Latest research and PCI guidelines confirm that DTMF masking is the new standard in MOTO telephone payment security – Simon Beeching, Business Development Director at Syntec

It seems that major customer data breaches are hitting the headlines with increased frequency. British Airways, Ticketmaster, Sears, Adidas, Macys, Kmart, Delta Airlines, Best Buy and MyFitnessPal are just some of the big name brands that have been hit in 2018 so far, and of course Marriott announced last week a hack affecting up to 500 million customers.

So it’s no surprise that the latest update of Syntec’s payment security consumer attitude tracking research reveals that concerns are now even greater about the risks of paying merchants by phone in the MOTO (mail order/telephone order) environment, to the extent that almost two thirds now say that there are times when they don’t buy something because of this – a proportion that has risen by almost 20% to 63% in just two years. Similarly, 31% of consumers now say that they never make payments by phone, up from just 19% who said the same in 2016.

The costs of a breach can be significant, both in terms of the direct expenses such as legal fees, forensic experts and compensation to the victims as well as indirect costs such as the time and effort spent notifying victims, and of course the loss of brand reputation and customer trust, higher customer turnover and damage to share value.
Consumers are growing more concerned about paying by phone

Our newly updated research further supports this, indicating that 81% of consumers would not give their details to a company that they knew had been breached. Even in cases where there hasn’t been a breach, consumers are still reluctant to hand over their card details, with 65% saying they are reluctant to make payments over the phone and 60% saying the risk of call centre fraud stops them making payments by phone.

Are consumers right to be concerned? The interviews we conducted with payment security experts across the industry, from merchant companies and payment providers to consultants and QSAs, show that the answer to this question is a clear ‘yes’. Card payment fraud in contact centres is on the rise, largely because fraudsters view contact centres as the weakest link in many organisations’ security.

Experts agree the risks of a breach are high

Most of the experts we interviewed agree that it’s not a question of ‘if’ a company gets breached but rather of ‘when’. This means that if organisations are storing payment card details within their own systems then they are vulnerable to having that data compromised.

Given that both the risk of being breached and also consumer concern about payment card security are growing, and the additional awareness of such data protection issues from the publicity around the GDPR legislation which put more onus on this for merchants in May 2018, it’s vital not only for merchants to take all the steps they can to ensure that their customers payment card details are secure, but that consumers see them to be secure.
Experts and consumers both select DTMF masking as the best way to ensure card security

What’s the best way to do this? Our research shows that both consumers and industry experts are in agreement here. When asked how organisations should best avoid fraud in contact centres, “using secure technology to hide the card details from both the call centre agent and the call recording” was the most popular response by a significant margin, selected by 42% of respondents.

This aligns with the views of the payment security experts and client organisations we interviewed. All the client organisations interviewed were looking for technical solutions to help them de-scope from PCI DSS. The view amongst the PCI assessors and security experts is that, whilst mitigating controls such as pause and resume (stop start) for call recordings can be useful in reducing risk, the best option for organisations is to de-scope entirely by creating a ‘no card data environment’ – and that DTMF masking is the best way to achieve this.

DTMF masking technologies enable consumers to enter their card details using their telephone keypads. The DTMF tones are then replaced with flat sounds before they reach the agent, who often hears only a single repetitive tone. The result is that the different tones made by the customer’s telephone keypad are concealed such that the agent cannot identify them by their sound.

The days of reading card details out over the phone are numbered

Kevin Dowd, ex-Chairman of the CNS Group and payment security expert, said,

“There’s pretty much universal agreement that the days of asking consumers to read their card details out over the phone are coming to an end. Consumers don’t like it and industry experts suggest that there are virtually no circumstances in which this approach is necessary.

“Reading your card numbers out is not an efficient way of doing things, nor is it secure.”

“In almost all instances, there is absolutely no need for a company to even see credit card data that’s going to bring them into PCI scope. DTMF is the solution for telephone payments. If I were running a call centre that’s how I would do it.”

It is clear from our research that consumers value the security of their data very highly and will adapt their behaviour accordingly, not shopping with organisations they perceive to be insecure, so the fact that an organisation is offering completely secure telephone payment should be promoted to consumers as a significant benefit. Switching to DTMF masking for telephone payments makes the consumer responsible for entering their card numbers just as they do in a retail or e-commerce environment and removes the risk of a data breach and the costs associated with that, as well as speeding up the payment process, reducing errors and improving efficiency.

“The biggest benefit [of switching to DTMF masking] has been the fact that we no longer have that dark cloud lingering over our heads. Not if we’re going to get breached, but rather when we’re going to get breached and when we do get breached, what’s going to happen. We no longer have to think about it. The liabilities are now gone. We’ve been able to streamline everything in a way, so that the collection of data is much more efficient.” says Carlos Moreno Tobon of Locus Telecommunications LLC.

The updated guidelines protecting telephone-based payment card data from the global PCI Security Standards Council, state that “For organizations committed to taking payments over the telephone, consideration should be given to techniques that minimize exposure of PAN and SAD to the telephone environment and balance that with user/customer experience requirements, with the object of significantly reducing the CDE [cardholder data environment] or eliminating the CDE altogether.” This further underlines that DTMF masking is becoming the new standard as recognised by the body set up by the card brands (Visa, Mastercard, American Express etc.) to oversee this whole area.

“A properly designed and deployed DTMF-masking solution can take not only the telephony environment, but also the agent environment and CRM system out of scope.”

Protecting telephone-based payment card data, PCI Security Standards Council, November 2018