A client reads a card number over the phone: then what?
Why a travel agency should not take or keep card numbers given by phone or e-mail, what PCI DSS means for it, and what to send the client instead.
By Achekam · · 5 min read · For Travel businesses in South Africa, Nigeria, Kenya
A regular client calls from the airport. Her flight home has been cancelled, she needs to be rebooked tonight, and she says, "Just put it on my card," before reading out sixteen digits, the expiry date and the code on the back. The consultant scribbles it all on a notepad, rebooks her, and later types the number into the airline's payment page. The notepad goes into a drawer.
Plenty of agencies work this way, and clients often expect it. But every card number written on a pad, typed into an e-mail or saved in a booking file is card data the agency now holds, with obligations attached. This article explains why that matters, which routes carry the most risk, what to use instead, and how to clean up the card details an agency has already collected.
Card data you hold is card data you must protect
PCI DSS, the Payment Card Industry Data Security Standard, is the card industry's security standard. According to the PCI Security Standards Council, it is aimed at every entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment, from merchants and processors to service providers. The Council's PCI DSS page is the official home of the standard and its supporting documents.
Stripe's guide to PCI compliance puts it more bluntly: all businesses that accept card payments must comply with PCI DSS, regardless of volume, region or how they take the payment. It describes compliance as three main parts: collecting and transmitting card details securely, storing data securely, and validating every year that the required security controls are in place.
A small agency in Mombasa, Abuja or Stellenbosch is not exempt because it is small. The more card data it handles directly, the more of that work it takes on.
Phone, e-mail and paper: the riskiest routes
Card numbers given by phone or e-mail travel along exactly the routes that are hardest to protect:
- Phone: the number is spoken aloud in an open-plan office, written on whatever paper is nearest, and sometimes captured in a call recording that nobody thinks of as card data.
- E-mail: the number sits in the client's sent folder, your inbox, your backups and any colleague's inbox it was forwarded to, indefinitely.
- Messaging apps: the same problem as e-mail, on personal phones the agency does not control.
- Paper: booking forms, notepads and printed itineraries with card numbers on them end up in drawers, files and bins.
Each of those copies is stored card data. None of them is easy to secure, and few agencies could show an auditor where every copy is.
Sending a pay link instead
The alternative is to keep the card number away from your staff altogether, by letting the client enter it on a payment page run by a payment provider. Stripe's guide explains why that matters for validation: when card details are entered into a payment field hosted by the payment provider, so the card data never reaches the merchant's own servers, the merchant can validate with SAQ A, whereas passing card data directly to a payment API requires SAQ D, the most demanding questionnaire. Which questionnaire applies to your agency depends on your whole set-up, so confirm it with your payment provider or acquiring bank; do not assume it from any single tool, including Achekam's pay links.
In Achekam, a business can create a payment link for an issued customer invoice, copy it or e-mail it with the invoice, and the client pays on a public page that shows the business's name and branding. A link lasts 14 days by default, and an open link for the same amount is reused. There is no link for a draft or voided invoice, so issue the invoice first. An issued invoice can also be downloaded as a PDF on your letterhead and e-mailed from the invoice with the link, and a failed send is reported as not sent.
In the airport scenario, the consultant rebooks the flight, issues the invoice for the change, and e-mails or messages the link while the client is still on the phone. The client pays from her own phone, and nobody at the agency hears a card number or writes one down.
Achekam saves no cards
Clients sometimes ask an agency to "keep my card on file" so future bookings are quicker. Achekam does not offer that. It never charges a business's customer automatically: there are no saved cards and no debit orders. The settings screen mentions that Peach offers card tokenisation for retainers, but Achekam itself does not save cards or charge them again.
So for repeat clients, each booking is a new invoice and a new pay link. That is a little more effort for a frequent traveller, but it means there is no store of card numbers in your system to protect. Corporate clients who book often are usually better served by monthly invoicing on account than by a card on file.
Cleaning up card numbers already on file
Most agencies that have taken card numbers by phone or e-mail for years have them scattered across the business. A clean-up is worth doing once, properly:
- Search the mailboxes of everyone who handles bookings for messages containing card numbers, and delete them, including from sent items and deleted folders.
- Check shared drives and booking files for scanned forms or spreadsheets with card details.
- Collect paper booking forms and notepads, and shred anything with a card number on it.
- Check call recordings if your phone system records calls, and ask your telephony provider how to remove card details from them.
- Write the rule down: card numbers are never taken by phone, e-mail or message; clients are always sent a pay link.
- Tell your clients, so a regular traveller is not offended when the consultant politely declines to take the number.
If a client insists on reading a number out, the consultant should stop them before they finish and offer the link instead. For refunds and cancellations that follow, see cancellations and refunds, and for what happens to the money after the client pays, gateway payouts and fees.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
