97% of UK flout guidelines on credit card security

Millions of credit card customers could be putting their details at risk thanks to negligent UK call centres, 97% of which repeatedly breach guidelines on data security, according to a report published today.

A nationwide survey of UK call centre managers by audio recording specialists Veritape found that calls containing sensitive details about customers’ credit cards, including their three-digit security code, are routinely stored on call centre computers, leaving credit card holders exposed to fraud.

This is in direct breach of global industry standards drawn up by the Payment Card Industry Data Security Council.
The report, called The Great Credit Card Gamble, found that over nineteen in twenty call centres that store recordings of transactional conversations with customers do not delete or mask any sensitive information revealed during these calls.

Cameron Ross, managing director of Veritape, said: “The storage of this actionable data creates a huge reservoir of sensitive information that is putting the financial resources of millions of people at risk.

“This practice ought to send a shiver up the spine of card holders and it is wholly unnecessary.”

Of the 133 call centre managers contacted by Veritape, only 3% said they complied with the guidelines. 39% claimed they were unaware that storing customers’ credit card details was in breach of standards, while 11% admitted they were aware of the rules but continued to flout them regardless.

Following the report’s publication, Veritape are urging call centres to delete all sensitive data from their recordings that could be stored, and reassure customers that their information is safe at the beginning of each phone call.

Mark Bowerman of the UK Cards Association said that customers should make sure they know and trust company to which they are speaking before handing over any credit card details.

“If call centres are storing a customer’s 3-digit security number they are putting them at risk of card-not-present fraud,” he said.

“Consumers should only give out credit card information if they have generated the call themselves and never reveal security details to a cold caller.”