PCI DSS Level 1 Certified

Agent-Assisted Payments Your agent stays. The card number doesn't.

Agent-assisted payments keep your agent on the live call while the customer keys their card on their own phone. We mask the keypad tones before they reach the agent's audio or the call recording, so the conversation never breaks and the card data never lands anywhere it shouldn't. One keypress to start the capture. One green light when the gateway responds. PCI scope drops from SAQ D to SAQ A the moment you connect.

What is an agent-assisted payment?

An agent-assisted payment is a card payment taken during a live phone call, with the agent on the line the entire time, but where the agent never sees or hears the card number. The customer keys their card details on their own phone keypad. Every keypress makes a DTMF tone, which we replace with a flat sound in real time before it reaches the agent or the recording. The digits go directly from the customer's handset to our PCI DSS Level 1 infrastructure and on to your payment gateway.

The agent stays where they're useful — answering questions, confirming details, handling the rest of the call. The card data takes a different path, one that never touches your business. That's what "agent-assisted" actually means: the agent is assisting the customer, not handling the card.

How agent-assisted compares to the alternatives

There are three ways to take a card payment on a phone call. Two of them put you in full PCI scope. Only one keeps you out.

Risky

Agent reads the card aloud

The customer reads the card number out, the agent writes it down or types it into a terminal, everyone overhears it. The recording captures every digit. Notes, forms, and CRM fields end up holding card data.

PCI outcome: SAQ D. 329 controls. Every recording and workstation in scope. Not where you want to be.

Limited

Transfer to automated IVR

The agent puts the customer on hold, transfers them to an automated payment line, and hopes they come back. Fast for simple payments. Cold for anything that needs a person.

PCI outcome: SAQ A, but the call flow is jarring. You lose the ability to help mid-payment, and drop-off rates climb.

Recommended

Agent-assisted with DTMF masking

The agent stays on the call. The customer keys their card on their own handset. We mask the tones before they hit the recording or the agent's audio. Conversation never breaks; card data never arrives.

PCI outcome: SAQ A, 22 controls, full human experience. The one we're here for.

How it works on a real call

1

Agent confirms the amount

Standard call, standard script — up to the moment of payment.

2

One-click capture start

Agent clicks 'Take payment' in your CRM or the Paytia console. Enters the amount.

3

Customer keys the card

The customer types digits on their own keypad. Every tone is replaced with flat audio.

4

Gateway authorises

Agent watches a progress bar. Approved or declined lands in seconds. Agent carries on the call.

What an agent-assisted payment does to your PCI scope

PCI DSS Level 1 Service Provider certification

PCI DSS Level 1

Our scope becomes yours the moment your card data takes our route. The work, the audit, and the evidence sit with us.

AreaWithout PaytiaWith Paytia
Self-assessmentSAQ D (329 controls)SAQ A (22 controls)
Network in scopeMost of your stackNone
Call recordingsRedact, pause-and-resume, or isolateCard-data free
Agent trainingMandatory and recurringNone required
Audit evidenceEvery touchpointProof of integration only

Where agent-assisted payments fit

Anywhere the customer benefits from a human on the line through the payment step.

Contact centres

Agents stay engaged through the capture. Useful for upsell, retention, and complex calls that don't naturally pause.

Financial services

Premiums, deductibles, excesses, repayments — where FCA-aligned handling and agent support both matter.

Collections

The call is usually the hardest bit. Keeping a human in the loop through the payment step protects the relationship.

Charities

Live fundraising calls, donor pledges, recurring gifts — without a volunteer writing card numbers on a pad.

Frequently asked questions

What is an agent-assisted payment?

An agent-assisted payment is a card payment taken during a live phone call, with the agent on the line the whole time, but where the agent never sees or hears the card number. The customer keys their card on their own phone keypad, the keypad tones are masked before they reach the agent's audio or your call recording, and the card goes straight to your payment gateway. The agent stays in the conversation — they can answer questions, confirm the amount, cross-sell, close the deal — but they're never the route the card data takes.

How is agent-assisted different from IVR?

IVR (Interactive Voice Response) is fully automated — the customer calls a number, a recorded voice walks them through, no human involved. That's fine for routine, low-value, high-volume payments, but it's a poor fit anywhere the customer needs help or the call has commercial substance. Agent-assisted keeps the human in the loop. Your agent stays on the call through the payment step, which means they can handle anything unusual — a wrong digit, a confused customer, a follow-up question, an upsell — without the call going cold. Same PCI protection either way; different conversation.

Why not just have the agent take the card number down?

Because that puts you in full PCI DSS scope — SAQ D, 329 controls, annual QSA audit, mandatory staff training, secure rooms, paper shredding, the works. It also puts the card data in your call recording, your agent's ear, your CRM notes, sometimes a Post-it. Any one of those becoming compromised is a reportable incident. Agent-assisted with DTMF masking removes every one of those touchpoints while keeping the agent where they're useful — on the call.

Does the agent know if the payment was successful?

Yes — immediately. A status panel in the agent dashboard shows the capture progressing in real time (digits entered, awaiting gateway, approved or declined), and the agent gets a clear approved/declined signal the moment the gateway responds. They can immediately pick the conversation back up — confirm the reference number, send the receipt, schedule the next payment, whatever the next step is.

Which phone systems does this work with?

Anything modern — traditional PBX, SIP trunks, and major CCaaS platforms. We integrate at the SIP or API layer and don't need on-premise hardware on your side. Most deployments are live within a week of a first call; the complex work is on our side, not yours.

What do agents need to learn?

Almost nothing. The agent sees a button in whatever dashboard they already use — a CRM, a bespoke tool, the browser-based Paytia console. They click it, enter the amount, and tell the customer to key their card. Everything else runs on its own. No scripts to memorise, no new software to master, no handoff to a payment team. The payment step becomes the same shape of task as asking for a postcode.

Does it work for MOTO payments?

Yes. Agent-assisted payments with DTMF masking are built for card-not-present telephone orders — which is what MOTO is. We tokenise the card on first capture so the same flow supports one-off payments, recurring billing, instalments, and follow-up charges. See our MOTO payments page for the broader card-not-present picture.

Keep the agent. Lose the card data.

We'll demo it against the same phone system and gateway you already use. Most businesses are taking live agent-assisted payments within a week.

PCI DSS Level 1
Cyber Essentials Plus

Trusted by law firms, insurers, healthcare providers and regulated businesses worldwide. Learn more about Paytia

Related solutions

Other ways to take payments in this channel.