Background
Carnival Corporation & Plc, headquartered in Miami, is a global cruise company and one of the largest leisure companies in the world. With a reputation for progression and innovation, its cruise brands include the well-known names of P&O Cruises, Cunard Line, Princess Cruises, Seabourne, P&O Cruises Australia, Holland America Line and Carnival Cruise Lines.
Their UK arm, Carnival UK, has a large call center that regularly takes card payment details from customers and agents over the phone.
Challenge
Carnival Corporation's UK arm, Carnival UK, is based in Southampton where its large 250-seat call center manages calls and bookings from both customers and agents, relating to several of their cruise brands.
Within this busy operation, agents take payments from customers by telephone. As Carnival UK records all of their calls and PCI DSS guidelines prevent the storage of credit card data in recorded calls, they were looking to implement a proven solution that would ensure further enhancements to customer data security.
The solution had to remove customer card details from voice system recordings and:
- Be compatible with Carnival's existing call recording system
- Have no effect on Carnival's green-screen reservation system
- Be able to manage screen recording as well as call recording
- Be rolled out quickly and smoothly, causing minimal impact on the business
Solution
Working with Carnival's IT team CallGuard was installed as an overlay to their existing IT infrastructure.
The filter was installed alongside their existing call recording system and USB Decoders were implemented at every agent's work terminal.
Together they allow customers to communicate their payment card details by using the telephone keypad during the course of a call.
CallGuard makes any call recording system PCI DSS compliant by stopping the recording of sensitive data by detecting and blocking DTMF tones.
CallGuard obscures card data with asterisks on the screen which means that payment data cannot be accessed, viewed or copied in any way.
“The team was responsive to our needs throughout the project. They were flexible in their approach and communicated progress at regular states, meeting all the challenges we set.”
Value
The solution was implemented quickly and smoothly without requiring changes to existing IT and telephony systems; furthermore, staff training was minimal and delivered remotely through WebEx.
CallGuard has further secured Carnival's busy contact center, which in turn has quickly become PCI DSS compliant, boosting customer confidence in their payment system.
Looking Forward
As a solution unique to Eckoh, we recognize that this example is likely a challenge many other enterprise organizations struggle with when they begin tackling payment security within their contact centers. Some organizations may even feel like their only option is to either deploy hardware on-premise – likely disrupting long-term cloud transformation strategies – or only achieve partial PCI DSS de-scoping.
As a result, the methodology innovated for The Client is now part of the Eckoh architecture. In fact, multiple other clients have also taken advantage of this solution, allowing them to maintain their existing telephony architecture while maintaining the strictest possible standard for payment security.
-1.svg)
