Contact Centre Platform Security Guide: Agent Desktops, Call Recording, Telephone Payments and Home Agents

A contact centre concentrates customer data, payment card details and account-changing powers in the hands of large, often outsourced and home-based agent teams, which makes it one of the easiest places to steal data at scale. Modern contact centres run on cloud CCaaS platforms, softphones, CRM-integrated agent desktops, call and screen recording, speech analytics and IVR, frequently delivered by a mix of in-house staff and business process outsourcers. This guide covers the platform security decisions that matter most: agent desktop and access design, call and screen recording, taking card payments by telephone under PCI DSS, home agents, and the insider and social engineering risk unique to support teams. It is for security architects, contact centre technology owners, PCI DSS programme leads and risk teams. Caller verification itself is covered in a separate guide.

Key takeaways

• Design the agent desktop around least visibility. Agents should see only the fields a call type needs, with card numbers masked and bulk lookup or export impossible.
• Keep card data out of the agent's ears and screens. DTMF masking, IVR transfer or secure payment links remove the agent, desktop and recordings from most PCI DSS scope; pause and resume removes only the recordings.
• Recordings are a sensitive data store. Card verification codes must never remain in audio after authorisation, and recordings and transcripts need encryption, access logging and retention limits.
• Home agents need managed devices or virtual desktops. PCI SSC guidance requires multi-factor authentication for remote connections to the telephony environment and systems handling card data.
• Plan for insiders and impersonation. Agents are bribed, coached and impersonated; monitoring of lookup patterns and strong agent identity matter as much as perimeter controls.

The contact centre attack surface

Telephony transport security (SIP over TLS, SRTP, session border controllers) is covered in the VoIP and SIP Security Guide and the Session Border Controller Security Guide. In short: SRTP (RFC 3711) provides confidentiality, message authentication and replay protection for the media stream, and should be enabled wherever the platform and carrier support it.

Agent desktop and access design

• Role per call type: build CRM and CCaaS roles around what each queue needs (billing, technical support, collections, fraud). A first-line agent rarely needs full payment history or the ability to change contact details without a second check.
• Mask by default: PCI SSC guidance says no more than the first six and last four digits of a card number should be displayed unless there is a legitimate business need. Apply the same principle to dates of birth, national identifiers and full addresses.
• Bind lookups to the interaction: where the platform supports it, allow a customer record to be opened only from an active contact (screen pop from the call) rather than free search. This single control limits casual browsing and bulk harvesting.
• Rate limits and export controls: cap record views per agent per hour, disable CSV export and printing for agent roles, and block clipboard and screenshot tools on the desktop where feasible.
• High-risk actions need step-up: SIM swaps, contact detail changes, MFA resets and refunds should require supervisor approval or a second verification step, recorded with both identities. See the Caller Authentication in Contact Centres.
• Agent identity: SSO with phishing-resistant MFA for agents and supervisors, no shared logins on shared seats, and immediate deprovisioning for leavers and outsourcer staff through SCIM or a joiner-mover-leaver feed.
• Admin separation: keep CCaaS administrators (flows, routing, recording policies, integrations) separate from supervisors, and give admins separate accounts from their daily ones. Platform-specific settings are in the Amazon Connect Security and Genesys Cloud Security guides.

Taking card payments by telephone

Spoken or keyed card details bring people, technology and connected infrastructure into PCI DSS scope. The PCI Security Standards Council's information supplement on protecting telephone-based payment card data sets out the scoping rules and the options for reducing scope. Its main points:

• VoIP is in scope: the entity's VoIP systems and networks that carry card data are treated like any internal IP network carrying card data.
• Demarcation matters: equipment where carrier voice terminates, whether owned by you or a provider such as a hosted PBX, is typically in scope, and providers must either validate their own PCI DSS compliance or be included in your assessment.
• Common scoping mistakes include poorly secured links from the contact centre to corporate, HR or finance systems, weak segmentation and forgotten business continuity sites.

Scope reduction options compared

Decision guidance: where customers can use a keypad, DTMF masking with off-premises processing gives the largest reduction and the best customer experience because the agent stays on the line. IVR transfer suits high volumes of simple payments and out-of-hours service. Payment links suit digital-first customers and smaller organisations without telephony integration budgets. Pause and resume is a recording control, not a scope reduction strategy, and should only be a stop-gap while one of the other options is introduced. See the Payment Card Data Elements for what counts as account data and sensitive authentication data.

Call recording, transcripts and analytics

• Sensitive authentication data: PCI SSC FAQ 1210 states that storing card verification codes in any form of digital audio recording after authorisation violates PCI DSS Requirement 3.3.1, even if encrypted. Prevent capture where possible, enable suppression or redaction features, and delete it immediately after authorisation if it is captured. Where secure deletion is technically impossible, compensating controls and documented risk assessments are required, and are reviewed in the annual assessment.
• Card numbers: a PAN in a recording must be rendered unreadable. Screen recordings showing card data need the same protection as audio.
• Verify, do not assume: the information supplement recommends regularly checking recordings (weekly is suggested) where pause and resume is used. Apply the same sampling to automated redaction and to transcripts, because speech-to-text output can contain digits that the audio redaction missed.
• Access and download: restrict who can search, play and export recordings, log every playback and download, and alert on bulk exports. Quality assurance teams rarely need download rights.
• Encryption and keys: encrypt recordings and transcripts at rest, and where the platform supports customer-managed keys, decide whether you need them for revocation or regulatory reasons.
• Retention: set retention by purpose (dispute handling, regulatory recording obligations, quality), apply it to backups and analytics copies too, and remember that PCI DSS does not override local audio retention laws. See the Data Retention and Secure Deletion Guide.
• AI assistants and analytics: agent assist, summarisation and sentiment tools receive the full conversation. Treat each as a data processor with its own integration identity, redact card data before it reaches them, and confirm where transcripts are stored and for how long.

Home and outsourced agents

PCI SSC guidance for remote workers requires multi-factor authentication for connections to the telephony environment or any system that processes card data, company-approved devices with firewall, anti-malware and current patches that users cannot disable, and secured home workspaces where card data is not accessible to others in the household. It also acknowledges that some controls are hard to enforce at home, so the risk must be assessed specifically and compensating controls applied.

• Physical controls at home: a private workspace, no paper notes of customer data, screen lock on idle, and a ban on personal phones being used to photograph screens, written into the agent agreement and covered in training.
• Outsourcers: document which party secures each system and process, require the provider's own PCI DSS validation where it handles card data, federate outsourcer agents through your identity provider rather than letting the outsourcer manage accounts in your CRM, and get prompt leaver notifications contractually.

See the Home Office and Remote Worker Security Guide and the Virtual Desktop (VDI) and DaaS Security Guide.

Insider risk and social engineering

Contact centre agents have legitimate access to many customer records and the authority to change accounts, which makes them targets for bribery, coercion and impersonation. In the Coinbase insider breach, bribed support agents exposed data of tens of thousands of customers. Help desks are also the target of voice phishing (ATT&CK T1566.004 Spearphishing Voice), where callers impersonate customers or staff to obtain resets.

• Screening and awareness: PCI SSC guidance recommends screening staff, including temporary workers and contractors, rescreening on moves into higher-risk roles, and making staff aware that organised crime may approach them and how they will be supported if it happens.
• Behavioural monitoring: baseline normal lookups per agent and queue, and alert on records opened without a matching contact, lookups of high-value or celebrity accounts, and access outside shift hours.
• Dual control for sensitive changes, so a single agent cannot complete an account takeover.

See the Insider Threat Programme Guide and the Vishing and Smishing Guide.

Where identity fits

Beyond agent accounts, a contact centre runs on non-human identities: CCaaS API keys used by CRM connectors, OAuth tokens held by ticketing and workforce tools, service accounts used by recording export jobs, and credentials used by AI assistants. Each typically has read access to every customer interaction. Inventory them, give each an owner, scope them to the minimum objects, rotate or federate them, and monitor their API usage for bulk reads.

Implementation steps

1. Map data flows: draw the card data and personal data flows across telephony, desktop, CRM, recording, analytics and outsourcers, with demarcation points for each party.
2. Remove card data from the agent path: choose DTMF masking, IVR or payment links; pilot on one queue, verify recordings and transcripts contain no card data, then extend.
3. Clean existing recordings: locate historic recordings that may contain card verification codes and delete or remediate them according to PCI SSC guidance.
4. Rebuild roles: map roles to queues, apply masking, contact-bound lookups and export limits; run in reporting mode first to see what agents actually use.
5. Secure remote delivery: move home agents to managed devices or VDI with MFA, and close browser-only access for roles that see sensitive data.
6. Turn on monitoring: forward CCaaS admin logs, CRM access logs and recording access logs to the SIEM with the alerts below.
7. Roll back safely: payment changes should run alongside the old process in a pilot queue so calls can be routed back if masking or IVR fails.

Detection and measurement

• Log: CCaaS admin changes (flows, routing, recording policy, integrations), agent logins and locations, CRM record views and exports, recording playback and downloads, integration API usage.
• Alert on: bulk record views or exports by one agent, recording downloads above a threshold, record access with no matching contact, admin changes outside change windows, and new integrations or API keys.

Framework mapping

Common failure patterns

• Relying on manual pause and resume: agents forget, card verification codes end up in recordings, and nobody samples them.
• Transcripts outside the redaction scope: audio is redacted but speech analytics stores the digits as text, searchable by a wide analytics team.
• Free search for every agent: any agent can look up any customer, so a single bribed agent can harvest thousands of records, as the Coinbase case shows.
• Browser access from personal devices for seasonal agents who can see full customer records.
• Outsourcer-managed accounts in your CRM with no leaver feed, leaving former agents active for weeks.
• Forgotten scope: business continuity sites, legacy recorders and old SIP trunks left out of the PCI DSS assessment.

Practitioner checklist

• Map card and personal data flows across telephony, desktop, CRM, recording, analytics and outsourcers.
• Take card payments through DTMF masking, IVR or payment links rather than spoken digits.
• Sample recordings and transcripts regularly for card data and delete any card verification codes.
• Mask card numbers and personal identifiers on agent screens and bind record access to active contacts.
• Disable export and bulk search for agent roles and alert on unusual lookup volumes.
• Require SSO with MFA for agents, supervisors and admins; keep admins separate from supervisors.
• Put home agents on managed devices or VDI, never unmanaged browsers for sensitive roles.
• Federate outsourcer agents through your identity provider with contractual leaver timelines.
• Inventory and scope integration API keys and tokens, and monitor them for bulk reads.
• Set recording and transcript retention by purpose, including backups and analytics copies.

Standards and references

• PCI Security Standards Council: Protecting Telephone-Based Payment Card Data, Information Supplement
• PCI Security Standards Council: FAQ 1210, Are audio/voice recordings permitted to contain sensitive authentication data?
• PCI Security Standards Council: Industry guidance on accepting telephone payments securely
• NIST: SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
• IETF: RFC 3711, The Secure Real-time Transport Protocol (SRTP)
• NCSC: Bring your own device guidance
• MITRE ATT&CK: Spearphishing Voice

Related NHI Mgmt Group resources: Caller Authentication in Contact Centres · Contact Centre Fraud Prevention · Unified Communications Security Guide · Vishing and Help Desk Social Engineering Awareness Guide