“Every day, hotel call centers record thousands of agent/customer conversations that contain sensitive credit card information,” said Bundock. “Some call recording systems provide encryption to secure the audio files. But the security resulting from encryption vanishes when playback for training purposes is initiated as the entire, unmasked credit card number is audible to the user, and anyone else within earshot.”

Recognizing the challenge of removing credit card numbers from audio files, the PCI Security Standards Council has made a temporary exception for audio recordings. However, that exception is based on there being no commercially reasonable technology to delete the card information and states that if removal becomes possible, the card numbers should be deleted.

Quality Track International, a company that provides call recording and agent performance grading services for call centers, and mystery shopping services for the hospitality industry worldwide, has developed a process that effectively and economically removes card numbers from audio files. The system has been installed in beta locations and excellent results have been obtained.

“The performance has been very impressive,” said Bundock. “We have processed thousands of recordings of hotel reservations and each one has been manually reviewed to determine if the number removal was successful. In every recording, the card number was obscured sufficiently to comply with current PCI DSS requirements.”
 
One of the challenges in removing card data from the recording of a reservation call is that the card numbers are spoken in many different ways and repeated during the confirmation of the reservation. Processes that rely on keyword triggers often fail to remove all instances of the card number. Systems that allow the agent to mute the recording are susceptible to agent error or fraud and can miss multiple occurrences of the numbers.

The Quality Track proprietary methodology isolates and removes card numbers while leaving important information like rates, confirmation numbers and phone numbers untouched. The card number removal process can be configured to operate on existing call recording systems. Patents are pending.

Testing and refinements are continuing and it is anticipated that a commercial product will be ready for release by the fourth quarter of 2008.