How to Set Up a PCI-Compliant Payment Workflow for Phone Payments Using Twilio – Twilio Support

Objective

Businesses often need to collect payment information from customers over the phone. To protect sensitive cardholder data and comply with PCI DSS (Payment Card Industry Data Security Standard), it’s essential to ensure that card details are never stored in call recordings and are securely processed. Twilio offers solutions to help you build a PCI-compliant workflow for phone payments, including automatic pause/resume of call recordings and secure payment capture.

Product

Programmable Voice

Environment

Twilio Console

Procedure

Key Features

PCI Mode: When enabled, Twilio redacts sensitive payment information from call recordings, ensuring compliance.
Automatic Pause/Resume Recording: Call recording is automatically paused when the customer enters card details and resumes after payment is processed.
Tokenization: Supports card-on-file use cases for repeat payments.
Programmable Voice Integration: Customize prompts and payment flows to fit your business needs.
Support for Major Credit Cards: Visa, Mastercard, and more.

Typical Workflow

Agent Initiates Payment Flow: During a call, the agent triggers the payment workflow.
Recording Pauses Automatically: When prompted for card details, Twilio pauses the call recording.
Customer Enters Card Details: Input is securely captured via DTMF (keypad) or spoken input.
Recording Resumes: After payment info is collected, recording resumes and the call continues.

Implementation Options

Twilio Studio: Use the Capture Payments widget for a no-code/low-code setup.
Twilio Studio Capture Payments Widget Documentation
Programmable Voice API & TwiML <Pay> Verb: Build custom flows using Twilio’s APIs and TwiML.
TwiML <Pay> Documentation
Twilio Flex: For contact centers, install the Call Recording Pause and Resume plugin (Flex UI 2.x.x recommended).

Compliance Notes

Enable PCI Mode: PCI Mode must be enabled in your Twilio Voice settings to ensure compliance.
Recording Retention: Recordings in PCI Mode are retained for one year by default.
Transcription: Native transcription is not available when PCI Mode is enabled.

Example TwiML Snippet

<Pay chargeAmount="99.99" validCardTypes="visa master-card" postalCode="false" maxAttempts="2" />

This snippet prompts the customer for payment, pauses recording during card entry, and resumes after.

Twilio provides robust tools to help you securely collect payments over the phone while maintaining PCI compliance. By leveraging Twilio Pay, Studio, and Flex, you can automate the pause/resume of call recordings and ensure sensitive data is never stored. For advanced needs, Twilio Professional Services are available to support your implementation. If you need assistance with implementation or custom development, Twilio Professional Services can help design and deploy a PCI-compliant payment workflow tailored to your business.

Additional Information

If you have questions or need further guidance, please reach out to your Twilio representative for personalized assistance.