Assess the actual payment path, not just a supplier’s PCI claim. PCI SSC states that VoIP traffic containing payment-card account data is within scope for applicable controls once it reaches the entity’s infrastructure. (pcisecuritystandards.org)
The future-dated PCI DSS v4.x requirements became effective on 31 March 2025; the v4.0.1 revision did not postpone that date. This is an existing standards obligation for relevant payment environments, not an upcoming 2027 change. (blog.pcisecuritystandards.org)
PCI SSC’s recording guidance addresses the prohibition on retaining sensitive authentication data after authorisation and the controls needed where recording creates difficulties. Buyers should not assume that encryption or a plan to redact later automatically resolves the issue. (pcisecuritystandards.org)
Recommended design: use a separately assessed payment-capture path and prevent card security codes from entering the agent’s transcript, model context, recordings and ordinary logs. Validate the result with the payment provider and assessor; do not accept a diagram alone.
Test interruptions, repeated digits, callers volunteering card details before the payment step, transfer failures and debug logging. The acceptance evidence should show what every relevant component actually received and retained.