PCI-DSS affects any VoIP system that processes, transmits, or stores cardholder data — including contact centers that take payments over the phone. The requirements go beyond just pausing recordings. Here's what VoIP engineers need to implement.
PCI-DSS scope includes any system that stores, processes, or transmits cardholder data (CHD). For VoIP, this means:
Even if your VoIP system doesn't store card data, if it transmits calls where card data is shared, it's in scope and must meet applicable PCI-DSS controls.
Got a PCAP of this happening? Drop it into the PCAP analyzer — it reads the SIP and RTP layers and reports the cause in seconds, free tier included. Or continue below for the manual approach.
PCI-DSS Requirement 3.3 prohibits storing sensitive authentication data after authorization. For call recordings, this means: you cannot record the portion of a call where a customer reads their card number. Organizations also serving EU customers should align these controls with GDPR for VoIP and call recording — both frameworks treat call audio as personal data with strict handling rules.
When customers enter card numbers via DTMF (touch-tone), the DTMF tones must be masked in two places:
In the audio recording: DTMF tones are audible audio events. The recording system must replace DTMF audio with silence or a masking tone during card entry. Some call recording platforms include DTMF masking as a feature — verify it works by testing with a real card number entry.
In SIP signaling: If using RFC 2833 DTMF transport, the DTMF digits appear as payload type 101 packets in the RTP stream and in SIP INFO messages. These must not be logged or stored in a way that exposes the card number sequence. SBC and proxy logs should not capture DTMF INFO message bodies.
PCI-DSS Requirement 1 requires network controls to restrict traffic to the cardholder data environment (CDE). For VoIP:
QSA (Qualified Security Assessor) auditors will review network diagrams and firewall rules. Ensure your VoIP network diagram clearly shows how CDE and non-CDE VoIP traffic are segmented.
PCI-DSS Requirement 4 requires encryption of cardholder data in transit over open/public networks. For VoIP:
TLS 1.0 and 1.1 are explicitly prohibited by PCI-DSS 4.0. Audit your SBC and SIP trunk TLS configuration to ensure TLS 1.0/1.1 are disabled.
PCI-DSS prohibits storing sensitive authentication data including card numbers after authorization. Call recording must be paused when customers read card data. CVV must never be stored in any recording. The recording platform must have access controls, MFA, audit logging, and recordings encrypted at rest.
Yes — PCI-DSS Requirement 4 requires encryption of cardholder data in transit over open networks. For VoIP calls that transmit or could transmit card data, SRTP is required for media encryption. TLS 1.2 is required for SIP signaling. TLS 1.0 and 1.1 are explicitly prohibited by PCI-DSS 4.0.
DTMF masking replaces the audible tones of a customer entering card numbers with silence or a masking tone in the call recording. PCI-DSS requires this because DTMF tones are audible and recognizable — without masking, a card number entered via touchtone could be reconstructed from the recording audio. Both audio masking in recordings and suppression of DTMF in SIP INFO message logs are required.
SIPSymposium Teams tier generates compliance reports mapping SIP trace findings to PCI-DSS requirements including encryption verification and DTMF handling assessment.