Major Telecoms Company

Protecting customer data, reducing business risk and achieving PCI DSS compliance by de-scoping their Card-not-Present transactions

Profile

Industry: Telecommunications Employees: 30,000 Revenue: $32.18 billion

Business: Telecommunications business providing wireless and internet services

Challenge: Need for PCI DSS compliance by de-scoping as much of the contact center

Solution: CallGuard, deployed on-premise

Benefit:

• PCI DSS compliance achieved
• Customer payments made secure
• Robust solution that's simple and fast to deploy

Background

This client is a wireless and internet service provider. They are one of the largest mobile network operators in the US with over 50 million customers. They also offer wireless voice, messaging and broadband services through various subsidiaries and wholesale access to this client is a wireless and internet service provider. They are one of the largest mobile network operators in the US with over 50 million customers. They also offer wireless voice, messaging and broadband services through various subsidiaries and wholesale access to its wireless networks. They have two data centers and 30,000 contact center agents.

Challenge

As the two contact centers take card payments over the phone and via their IVR, they needed to comply with the Payment Card Industry Data Security Standard (PCI DSS) and ensure their business could grow.

They were seeking a solution that would significantly reduce the burden of compliance by removing as much of their contact center from the scope of the PCI DSS audit as possible and meet their very short production installation timelines. The client particularly wanted to include their session border controllers in the de-scoping of their contact center.

Solution

The client chose Eckoh to deliver its patented CallGuard Audio Tokenization On-site solution, with full CTI integration because it is the most secure solution available to de-scope data from PCI DSS scope. It also has zero impact on the client's internal processes and third-party token vault process.

When a customer keys in their card details using their phone keypad, audio tones (DTMF) are generated.

Eckoh's solution instantly replaces these tones with an audio token, which is automatically placed directly into the payment field on the agent's screen. As the token data is not real card data it is completely meaningless and of no value to a criminal.

In addition, because Eckoh does all of the heavy lifting for the implementation, Eckoh could guarantee their desired go-live date would be met. CallGuard is also much quicker to install as there is no need for API and application development changes.

Value

• PCI DSS compliance was achieved and all of their call center transactions are de-scoped.
• CallGuard has become the default payment capture method input for their permanent token provider when capturing new payment data information.
• No sensitive data is seen or heard by agents, captured in the call recording, stored in systems or traverses their networks — not even their session border controllers. As there's no data in the system, there is nothing to steal.
• The contact center agents can take card payments from their customers over the telephone and via their IVR in a secure manner.

Looking Forward

As a solution unique to Eckoh, we recognize that this example is likely a challenge many other enterprise organizations struggle with when they begin tackling payment security within their contact centers. Some organizations may even feel like their only option is to either deploy hardware on-premise – likely disrupting long-term cloud transformation strategies – or only achieve partial PCI DSS de-scoping.

As a result, the methodology innovated for The Client is now part of the Eckoh architecture. In fact, multiple other clients have also taken advantage of this solution, allowing them to maintain their existing telephony architecture while maintaining the strictest possible standard for payment security.

To learn more about how Eckoh secures payments across all engagement channels, reach out to one of our trusted advisors.