How
It Works
Most businesses taking card payments over the phone assume they must complete SAQ D — over 300 PCI controls. Most shouldn't. If card data never enters your phone system and your agents cannot hear or see full PANs, you can typically qualify for SAQ A — just 22 controls. The difference? Months of work versus weeks. This is achieved through DTMF masking: customers enter card numbers via keypad while tones are securely masked. No card data touches your environment.
Solution Overview
Discover how our solution can help your business
Trusted by businesses of all sizes to protect their staff, customers and business brand
How It Works
SAQ A vs SAQ D · DTMF Masking · Fewer Controls, Lower Cost
Why Most Businesses Think They Need SAQ D
Under PCI DSS, if your staff hear, see, retype, or write down card data — or you use virtual terminals where card details are entered into your systems — your environment is in scope. The PCI Security Standards Council requires merchants in that situation to validate against the full set of controls. SAQ D (Self-Assessment Questionnaire D) for PCI DSS v4.0.1 has over 300 requirements for merchants. That means extensive security measures, documentation, training, and ongoing monitoring.
When You Can Qualify for SAQ A Instead
If cardholder data never enters your systems and your people never have access to full PANs (Primary Account Numbers), you may qualify for SAQ A — just 22 controls (the shortest self-assessment). Paytia achieves this by ensuring card data is captured via DTMF masking: the customer enters digits on their keypad, tones are masked, and only your payment processor receives the data. Your agents stay on the line to help but never hear or see the card number.
DTMF Masking in Practice
DTMF (Dual-Tone Multi-Frequency) masking means the keypad tones are replaced or suppressed so that call recordings and anyone on the call cannot recover the card number. The payment is still authorised in the normal way by your acquirer or payment provider. Because your business never possesses, processes, or stores card data, your PCI scope is dramatically reduced — and so is the cost and effort of compliance.
The Cost of Virtual Terminals and Staff Handling
Virtual terminals from banks and manual entry by staff put card data in your environment. That triggers the need for network segmentation, access controls, training programmes, secure disposal, logging, and annual assessments. The result is significant cost: security infrastructure, training, audits, and the risk of fraud and breach. Paytia removes that requirement — reducing compliance cost, fraud risk, training burden, and security red tape.
Less Work, Fewer Controls
With Paytia, card data does not touch your people, processes, or systems. You avoid the heavy lift of SAQ D: no need to prove hundreds of controls, maintain complex policies, or budget for evolving PCI DSS changes. Many customers achieve a substantial reduction in scope and move to a simpler validation path, with predictable annual cost and less operational overhead.
No Card Data, No Scope
Paytia is a PCI-DSS Level 1 certified payment capture provider. Our service is designed so that card data never enters your call recordings, databases, or agent workflows. That means you can focus on running your business instead of maintaining the security measures required when card data is present in your environment.
On this site you can read about our agent-assisted payments, DTMF suppression, keypad payments, and telephone payments; our PCI DSS compliance and PCI checklist; and our integration docs, videos, and demo.
SAQ D controls vs 22 for SAQ A
PCI-DSS certified
Not months — simpler validation
Frequently Asked Questions
Paytia documentation and product pages
The services and topics mentioned on this page are described in detail across our product and documentation site. Use the links below to explore.
Product & solutions
- Agent-assisted payments – payments with agents on the line
- DTMF suppression – how we mask keypad tones
- Keypad payments – secure keypad capture
- Telephone payments – card payments over the phone
- Call center payments
- PCI DSS solution – scope reduction
- Accept credit card by phone
- All solutions
Documentation & resources
- PCI DSS compliance – full compliance page
- PCI DSS (legal) – policy and certification
- PCI compliance checklist (UK)
- Integration & APIs
- Knowledge base
- Support center
- Videos & demos
- Blog – guides and updates
- Case studies
- Book a demo
When Card Data Is in Your Environment
Virtual terminals, staff hearing or seeing card numbers, and manual entry put you in scope for the full set of PCI DSS controls. With DTMF masking, card data never enters your systems.
With card data in your environment (SAQ D)
- • 300+ PCI DSS requirements to satisfy
- • Security policies, training, and access controls
- • Ongoing monitoring, logging, and reviews
- • Higher cost and more red tape
With Paytia — no card data (SAQ A eligible)
- • Just 22 controls; simplest self-assessment
- • No card data to train staff on or protect
- • Reduced fraud risk and compliance cost
- • Weeks of effort, not months