Pay by phone (IVR) payments for Canadian organizations: how they work and who they suit.

The short answer

• No one hears the card number. In an IVR payment, the caller keys the card into an automated system, not to an agent.
• There are three common setups. An agent takes the card by voice, an agent stays on the line while tones are masked, or the call moves to an IVR.
• IVR can shrink what PCI DSS covers. PCI SSC says a well-built setup could reduce PCI DSS duties for agents and their desktops, once that is verified.
• The security code must not be kept. PCI SSC says this data must not be stored after approval, including in call recordings.
• Two providers are involved. A telephony provider runs the phone line. Your merchant account processes the card.

What an IVR payment is

PCI SSC, the body that writes the card security standard, describes IVR as technology for calls between people and computers. It can collect data by voice or by keypad tones. Keypad tones are called DTMF (dual-tone multi-frequency). Each key makes its own sound.

PCI SSC calls an IVR payment an "unattended" transaction. A typical call runs like this:

1. The caller gives their account or order details.
2. The agent, or the menu, transfers the caller to the IVR.
3. The IVR asks for the card number and security code on the keypad.
4. The IVR gets the approval or decline and tells the caller.
5. The caller can return to an agent if the line is set up for it.

PCI SSC says the IVR can sit in your own phone system or with a third party, such as a payment service provider or acquirer. The agent can hang up while the caller pays.

Three ways to take a card by phone

PCI scope: what PCI SSC says

PCI DSS applies to any business that stores, processes or sends card data. That includes merchants, processors and service providers. See PCI DSS. "Scope" means the people, systems and networks the standard covers.

PCI SSC's telephone guidance says these points, in summary:

• The security code is sensitive authentication data. Only issuers may keep it after the payment is approved. If it is recorded, it must be made unrecoverable once the payment is approved.
• Unmasked keypad tones can be turned back into digits. A recording that holds them is fully in scope.
• With masking, any delay can let part of a tone slip through. PCI SSC calls this "DTMF bleed" and says none should remain.
• An IVR could reduce PCI DSS duties for agents and their desktops. It must first be verified that card data bypasses them.
• If a third party runs part of the phone setup, both sides should agree in writing who secures what.

Who IVR payments suit

IVR fits organizations that send bills and get many calls to pay them. A few examples:

For clinic and hospital payments in general, see our healthcare page.

Setting up an IVR payment line

1. Map the calls. List what callers pay for and what they need to say or key in, such as an account number.
2. Choose the telephony provider. It runs the phone number, the prompts and any masking.
3. Set up the merchant account behind it. The account must allow card-not-present payments.
4. Connect and script. The IVR sends payments to your gateway. Write the prompts in English and French if your callers need both.
5. Test. Run approvals, declines, refunds and a full day's deposit. Check that recordings and logs hold no card numbers.
6. Launch and review. Listen to sample calls and check deposits against your billing system.

Phone payments are card-not-present sales, which usually cost more than tapped or inserted cards. See our card processing fees guide.

Getting callers to use it

Practical steps that help callers find and trust the line:

• Put it on the bill. Print the IVR number and the account number the caller will need.
• Offer it first. Make paying by phone the first menu option for billing calls.
• Give staff a script. Agents can offer to transfer callers to the payment line and explain why.
• Keep an exit. Let callers return to a person if a payment fails.
• Confirm every payment. Read back a confirmation number the caller can write down.

Where CleverPays fits

PCI SSC writes the security standard. Card networks such as Visa and Mastercard set card rules. Your acquirer decides how you prove compliance. The telephony provider runs the phone system, the prompts and any masking. You own your billing process and your call scripts.

We can scope an IVR payment line with you, with the merchant account behind it. We can help you connect the line to your payments and test approvals, refunds and deposits before launch. We can review your current card statement at the same time. We stay your contact in English and French. We do not certify PCI compliance, and we do not run the phone system.

Common questions