PCI DSS payment-by-phone for UK SMBs
How DTMF redaction keeps you in SAQ-A scope and saves the £20k a year that a full PCI audit costs.
If you take card payments over the phone, you are in PCI DSS scope. The default scope (SAQ-D) is a £15-25k annual headache. With DTMF redaction you can drop to SAQ-A — a 20-page self-assessment instead of a 350-page one.
What PCI DSS is
The Payment Card Industry Data Security Standard is the contract you signed with your acquiring bank when you started taking cards. It's not law, but a breach lets the card schemes fine you £50-£90 per exposed card and revoke your merchant account.
The four PCI scopes that matter for phone payments
- SAQ-A — you never see, store or transmit cardholder data. Easiest scope. Achievable with DTMF redaction or tokenised links.
- SAQ-A-EP — your website redirects to a payment processor (e.g. Stripe Checkout). Not phone-related.
- SAQ-D-Lite — you handle cardholder data on the phone, but you have DTMF capture + recording redaction. Mid-difficulty.
- SAQ-D (full) — agents read and type the card. Worst case; full PCI audit.
How DTMF redaction works
When the caller presses card digits on their keypad, those tones (DTMF) travel as in-band audio. Silux Call's PCI module:
- Detects entry into the dialplan extension you've designated as the “payment-capture” trigger.
- Mutes the recording stream for the duration of the digit entry.
- Writes a redaction marker into the recording metadata so auditors can see *when* digits were collected without ever hearing them.
- Tokenises the digits with Stripe before they touch your dialplan log.
The cost saving
| Scope | Typical annual cost |
|---|---|
| SAQ-D (full QSA audit) | £15,000-£25,000 |
| SAQ-D-Lite | £3,000-£6,000 |
| SAQ-A (with DTMF redaction) | £500-£1,500 |
Enabling it in Silux Call
Go to Dashboard → Recording & PCI settings, switch on PCI DTMF redaction, and set the dialplan trigger extension. Default is payment-capture — match it with the macro name in your IVR.
Common gotchas
- Recording on the agent's headset — if your agents use a third-party recorder (Verint, Calabrio), it bypasses our redaction. Disable it.
- Background noise gates — some headsets pick up the DTMF tone via the agent's microphone. Silux Call's policy gates the agent side too.
- Manual entry by the agent — if your agents *type* the card on a web form instead of using DTMF, you're back in SAQ-D scope. Use our Stripe Elements path (Feature 1B) instead.
Other guides
- UK PSTN switch-off 2027: what every small business must doguide
- How to port your UK phone number to VoIP (PAC and STAC explained)guide
- Silux Call vs bOnlinealternative
- Silux Call vs Yay.comalternative
- Silux Call for Estate agentsindustry
- Silux Call for Legal practicesindustry
- PSTN switch-off countdown 2027: what every UK SMB must do in the next 12 monthsblog
- Pre-ring AI scam shield: why your UK business phone should drop scam calls before it ringsblog
Move to Silux Call today.
Free tier, no card needed. UK GBP, UK support.
Start 30-day free trial — no card