Handling Payment-Sensitive (PCI) Calls in a Voice Agent Safely

To handle payment-sensitive calls safely, keep card data off the voice agent's call. A spoken card number would reach the speech and language models, the transcript and the recording. Verify the caller and confirm the amount, then have your payment provider send a secure payment link by text or email, or transfer the caller to a payment line.

Key Takeaways

• A spoken card number lands in the models, the transcript and the recording.
• Send a secure link from your payment provider, or transfer to a payment line.
• Pausing the recording still leaves the digits with the speech and language models.

This post is part of our guide to compliant AI voice agents. The guide's section "Payment calls: keep card numbers off the line" starts from one rule: "The safe way to handle payments on a voice agent is to keep card data out of the call entirely." Here is why, and how to build both safe designs in Dograh, an open-source, self-hostable voice agent platform.

Where a spoken card number ends up

A card number read aloud on a voice agent call lands in five places at once. The speech-to-text model hears it, the language model holds it in its context, and the transcript, the recording and any trace store it. On a human call, the risk sits mostly in the recording. On a voice agent, it also sits with every model in the call.

Dograh does not redact recordings or transcripts. Recordings and transcripts keep whatever is said, so the call never asks for a full account, card or Social Security number; use a short check such as the last four digits, and send payment links by text or email from your own system. Recording upload is on by default and can be switched off only for the whole server, with ENABLE_CALL_RECORDING_UPLOAD=false, and transcripts are still saved.

Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. So a hosted model hears every digit too, and the audio stays in-house only when those models run on your own servers. Dograh has no keypad (DTMF) tool and no feature for taking customer payments on a call, so keypad masking is off the table here, and the designs below keep card data away from the agent entirely.

The card industry describes the same risk. The PCI Security Standards Council's guidance on telephone payments says: "Recordings will capture clear-text CHD and SAD if spoken by the cardholder or captured through DTMF tones, and where the entire conversation is recorded." CHD is cardholder data, such as the card number. SAD is sensitive authentication data, such as the security code on the back.

What PCI DSS says about card data in recordings

PCI DSS treats a recorded security code as stored sensitive authentication data. PCI SSC FAQ 1154 states: "PCI DSS Requirement 3.3.1 prohibits storage of SAD after authorization, even if encrypted." A security code sitting in a call recording or transcript is generally that kind of storage.

FAQ 1210, on audio recordings, sets the order of preference: "If SAD is collected during a call, every effort must be made to prevent the data from being recorded. Where technology exists to suppress or redact audio during data entry, it should be enabled."

A voice agent has no clean way to suppress audio mid-call, since the models need the audio to work. So the practical reading is generally to keep card data out of the call altogether. When card data never reaches the agent, its recordings, transcripts and models generally stay out of card-data scope. Your Qualified Security Assessor (QSA) or acquirer decides your actual scope.

Why pausing the recording does not work here

Pause-and-resume stops the recorder while the caller reads the card, and it has a known weakness even on human calls. The same PCI SSC guidance warns: "Recordings may capture CHD or SAD if pause-and-resume is used, depending on the accuracy of the pause-and-resume process."

A voice agent adds a bigger gap. Even with the recording paused, the speech-to-text model and the language model still hear every digit, and the transcript still records the turn. Callers also start reading their card before anyone has paused anything. Pausing protects one copy out of five, so treat it as a backup at most.

Design one: a secure payment link from your provider

The cleanest design moves the payment to the provider's own page. Before any of that, the agent greets the caller, confirms identity with an approved check such as date of birth, and only then reads the amount and due date from your billing system.

When the caller wants to pay, an HTTP API tool asks the business's own payment provider to send its secure payment link by text or email. The HTTP API tool's Custom Message (text or a recorded clip) plays once, just before the tool runs, so the caller hears that a link is on its way. The caller pays on their own phone, and the card number never touches the call.

Your payment provider then reports the result to your own system. Tell the agent in the prompt to record whether the caller agreed to pay and when, as the caller stated it, and never to confirm a payment the provider has not reported. Our post on claims document collection uses the same pattern with a secure upload link, and telecom bill reminders uses it for bills.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Design two: hand over to a payment line

Some callers want to pay by phone, and a payment line already set up for card data can take them. Transfer Call works on Twilio, Telnyx and Asterisk ARI. It passes no summary by default; on Twilio it can play a short spoken introduction to both people. Write the details to your system with an HTTP API tool before the transfer.

Those details are the account reference and the amount, never card data. If nobody answers within the 30-second default, the caller stays with the agent; tell it in the prompt to offer a callback or the payment link instead. Browser test calls cannot transfer, so test this path over a real phone call.

If a caller reads card digits anyway

Callers will sometimes start reading their card number before the agent can stop them. Tell the agent in the prompt to interrupt any caller who starts reading card digits, explain that it cannot take card details on this call and offer the link or the payment line instead.

Whatever the caller said before that point is now in the transcript, the recording and the model calls. Dograh has no retention setting and deletes nothing automatically, so your team finds that call and deletes the card data from your own storage, under a written process your QSA has seen. If the call went through a hosted model, check that provider's own retention terms too.

Callers also need to know the call is recorded at all. That notice belongs in the Greeting Text, as our post on call-recording consent laws explains.

Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee. This is general information, not advice on your PCI DSS scope. Confirm your scope with your QSA or acquirer.