Feeds

Survey: Call centre data standards 'routinely ignored'

Poor practice creates 'vast reservoir of sensitive data'

The essential guide to IT transformation

More than 95% of call centres were found to store customers' credit card details in recordings of phone conversations in breach of industry rules, according to a survey conducted by a call recording technology company.

Veritape said that when it talked to 133 call centre managers, only 39% of them knew about industry rules against the storing of the information and just 3% of them wiped credit card numbers from recordings of phone calls. Veritape provides call recording services to the call centre industry.

"The routine practice of storing unedited audio recordings of calls is creating a vast reservoir of sensitive data on the servers of call centres across the UK, in direct breach of global industry standards drawn up by the Payment Card Industry Data Security Council," said a Veritape statement.

The industry guidelines are contained in the Payment Card Industry Data Security Standard (PCI DSS), which governs how companies should treat data, whether they be physical shops, websites or call centre sales operations.

Veritape pointed out that one clause of the Standard forbids the storing of the three digit verification number on the back of cards in transactions conducted remotely. "Sensitive authentication data must not be stored after authorization (even if encrypted)," says a footnote to the Standard highlighted by Veritape.

Veritape said that its survey of 133 call centre managers found that of the 97% who did not comply with this rule in relation to audio recordings, 61% did not know of the rule, 18% said it would be too difficult or expensive to comply, 11% were ignoring the issue and 6% were working to become compliant.

“What we have is a global industry standard that is routinely ignored by call centres throughout the UK,” said Cameron Ross, managing director of Veritape. “The storage of this actionable data creates a huge reservoir of sensitive information that is putting the financial resources of millions of people at risk."

Veritape said that its software records phone calls and can process data contained within calls, acting, it said, "as a powerful telephone search engine".

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.