The focus of government agencies and laws has been growing in recent years on consumer protection and privacy, with checks and inspections becoming more frequent and penalties increasingly severe for those who do not comply.
Even in the world of Contact Centers, the management of sensitive data is an increasingly present issue and the number of human resources assigned to the field of care of compliance and risk management is growing.
Contact centers are required to carefully follow and stay up to date on the PCI standard guidelines regarding the collection of conversations with their customers; therefore, they must be able to ensure constant monitoring in order to remain compliant.
Even a single agent can severely impact your company’s reputation and customer satisfaction, as well as cause your company to incur high costs. Obviously, dispensing with call recording is not an option, as records are necessary for performance evaluation, but also to facilitate the conduct of any legal proceedings. As a result, the need to monitor and analyze 100% of calls is becoming a key requirement.
The role of Quality Assurance and training are closely tied to compliance, and it is crucial to be in line with best practices and adopt the necessary technology to do so. Side-by-side and spot checks during calls take too much time and are highly risky. In addition, these traditional methods fail to give you the full picture of your contact center’s activities.
By monitoring and evaluating all interactions between customers and agents, you can validate your scripts and verify that they are being adhered to. This will allow you to identify gaps in your employees’ knowledge and provide specific training where necessary, preventing possible errors.
This is also vital towards providing a safe environment and towards improving and protecting the experience of your agents, as well as avoiding lawsuits and loss of consumer confidence.
Potential capitalize cost, security, and breach
Ill-prepared contact centers can incur fines of up to 500,000 euros, but that’s not all.
There are other costs associated with breaching these standards, such as the increased verification checks that result from your activities (which will not cease until you become compliant), the cost of notifying customers, and the loss of revenue due to the suspension of operations during the audit and the resulting impact on your corporate image. In the most severe cases, it can even result in the suspension of all transaction-related activity and cardholder data. These costs can be fatal to small and medium-sized businesses.
Legal action can be taken by both the customer and payment card services companies, with monthly fines bringing long-term losses.
Knowing that a company has experienced litigation regarding the security of customer account data management is irreparable damage that undermines brand trust.
Methods for Ensuring PCI Compliance
The primary methods used in the contact center industry to ensure compliance can be divided into two types:
– Traditional
– Innovative (with SW support)
The first traditional method is manual filtering, where a supervisor, once calls are completed, manually removes or obscures the part of the call containing sensitive data. This type of approach, besides being extremely time-consuming, in many cases, due to the repetitiveness of the activity, leads to oversights, thus making it unreliable.
The second traditional method gives the agent the possibility to stop recording the call when the authentication phase is reached. This methodology then renders the agent unable to collect sensitive data. Again, there are three elements to consider:
- The recording may not be reactivated due to agent oversight, thus resulting in the loss of a segment of the conversation.
- The second factor concerns the agent’s responsiveness and attention towards interrupting the call at the right moment, with the risk of being anticipated by the client and thus recording their sensitive information.
- The last element concerns the improper use of the pause, with the potential to lose track of parts of conversations relevant to the evaluation of a call.
Newer methodologies, on the other hand, rely on technological support:
You can rely on your IVR, redirecting the customer to manually enter their data via the keypad, thus leaving a high margin for error.
You can rely on the latest recorders that automatically cut off the call, but again, double-checking is essential.
The other possibility is to rely on Speech Analytics software to spot the sensitive information through the interactions, thanks to text analysis and filtering capabilities. Speech recognition technology can recognize phrases such as “my card number is…” or recognize when the agent is about to ask for such specific information. After recognizing the part of the call that is potentially hazardous to compliance, the platform will overwrite the audio of the recording with a sound and also proceed to obscure the transcript, so as to make that specific data inaccessible.
Xdroid has specifically chosen the latter solution to help contact centers be compliant.
The Xdroid PCI compliance module is used for redacting sensitive information in the calls, such as credit card information, payment information, or other personal information of your customers. It automatically removes any sensitive information to ensure PCI compliance in your company with Xdroid’s flexible rule mechanism. Once the redaction module is working, redacted information will be deleted from the transcript and the relevant part of the audio will be silenced.
You can use the PCI compliance module in all recorded calls and historically recorded calls as well. The precise transcription and the advanced rule mechanism help you create any lifelike scenarios in PCI compliance.
Callenges to achieving PCI DSS Compliance
There are a few challenges that must be overcome in order for a company to be PCI compliant; the first of all is understanding that relying on technology alone is not enough. That’s why within every implementation at Xdroid make sure that our solution is seen as a tool to achieve success and not success itself. Human resources all need to be properly briefed on how to meet compliance. With VoiceAnalytics we give the ability to analyze 100% of calls in order to recognize any potentially critical elements, and with the fully automated and transparent call evaluation system, we offer the ability to identify any knowledge gaps. This allows you to go to work on targeted training for those who need it, provide an environment of protection and care for your agents, and empower the agents themselves to be more aware of how they are performing and to start a process of self-empowerment that allows them to constantly improve.
