PCI DSS payment-by-phone for UK SMBs

How DTMF redaction keeps you in SAQ-A scope and saves the £20k a year that a full PCI audit costs.

If you take card payments over the phone, you are in PCI DSS scope. The default scope (SAQ-D) is a £15-25k annual headache. With DTMF redaction you can drop to SAQ-A — a 20-page self-assessment instead of a 350-page one.

What PCI DSS is

The Payment Card Industry Data Security Standard is the contract you signed with your acquiring bank when you started taking cards. It's not law, but a breach lets the card schemes fine you £50-£90 per exposed card and revoke your merchant account.

The four PCI scopes that matter for phone payments

  • SAQ-A — you never see, store or transmit cardholder data. Easiest scope. Achievable with DTMF redaction or tokenised links.
  • SAQ-A-EP — your website redirects to a payment processor (e.g. Stripe Checkout). Not phone-related.
  • SAQ-D-Lite — you handle cardholder data on the phone, but you have DTMF capture + recording redaction. Mid-difficulty.
  • SAQ-D (full) — agents read and type the card. Worst case; full PCI audit.

How DTMF redaction works

When the caller presses card digits on their keypad, those tones (DTMF) travel as in-band audio. Silux Call's PCI module:

  1. Detects entry into the dialplan extension you've designated as the “payment-capture” trigger.
  2. Mutes the recording stream for the duration of the digit entry.
  3. Writes a redaction marker into the recording metadata so auditors can see *when* digits were collected without ever hearing them.
  4. Tokenises the digits with Stripe before they touch your dialplan log.

The cost saving

ScopeTypical annual cost
SAQ-D (full QSA audit)£15,000-£25,000
SAQ-D-Lite£3,000-£6,000
SAQ-A (with DTMF redaction)£500-£1,500

Enabling it in Silux Call

Go to Dashboard → Recording & PCI settings, switch on PCI DTMF redaction, and set the dialplan trigger extension. Default is payment-capture — match it with the macro name in your IVR.

Common gotchas

  • Recording on the agent's headset — if your agents use a third-party recorder (Verint, Calabrio), it bypasses our redaction. Disable it.
  • Background noise gates — some headsets pick up the DTMF tone via the agent's microphone. Silux Call's policy gates the agent side too.
  • Manual entry by the agent — if your agents *type* the card on a web form instead of using DTMF, you're back in SAQ-D scope. Use our Stripe Elements path (Feature 1B) instead.

Move to Silux Call today.

Free tier, no card needed. UK GBP, UK support.

Start 30-day free trial — no card