Pay by Call: PCIaaS layer for secure phone payments

Accept secure and authenticated phone payments in your contact center and eliminate fraudulent chargebacks, without changing your bank or PBX

PaybyCall is not a PSP and does not replace your bank. It is a cloud-based security platform that connects your contact center to your bank/PSP, enabling you to accept payments over the phone without your agents or systems accessing card data. We provide PCI DSS compliance as a service (PCIaaS) to reduce certification costs and complexity. We incorporate SCA/EMV 3DS authentication during the call, without switching channels or sending payment links, providing protection against fraudulent chargebacks through liability shift on eligible transactions and preparing your contact center for Secure Agentic Voice Commerce.

“PaybyCall is not a payment service provider (PSP) and does not process the payment itself. It is the technology layer that secures the voice interaction: it captures card data securely in compliance with PCI DSS and integrates and orchestrates EMV 3DS cardholder authentication within the call itself. This enables PSPs to execute secure, authenticated transactions, bringing the benefits of SCA to the telephone channel, where they were previously unavailable.”

The phone channel remains the weak link in security.

Agents who hear card numbers, recordings containing sensitive data and unauthenticated MOTO transactions. Every traditional phone payment expands your PCI DSS scope, exposes you to data breaches and leaves the risk of fraudulent chargebacks on your books. Until now, the industry’s usual alternative has been to send a payment link, which breaks the conversation: the customer leaves the call, distrusts an SMS or email link that may look like phishing and, all too often, never completes the payment.

Human exposure

the operator listens to and manipulates card data.

Toxic recordings

PAN/CVV data is stored in audio files and processes.

Regulatory incompatibility

friction with PSD2 and more operational risk.

Outdated experience

slowness, errors and low conversion.

“PaybyCall turns the telephone channel into a secure, authenticated payment environment: PCIaaS protects card data and reduces the contact center’s PCI DSS scope, while PBC 3DS adds EMV 3DS strong customer authentication to verify the payer. Together, PCIaaS + PBC 3DS enable ATO (Authenticated Telephone Order).”

From MOTO to ATO: Turn Every Contact Center into an Authenticated Payment Channel.

PaybyCall acts as a secure IVR layer: customers enter their card details directly on their phone keypad using DTMF masking technology, with no exposure to agents or call recordings.

It integrates seamlessly with the customer’s existing phone system and bank, with no need to replace their current infrastructure

ATO: Authenticated Telephone Order is the natural evolution of traditional telephone payments.
While traditional MOTO lets you take payments during a call, ATO adds an essential layer: authenticating the cardholder via EMV 3DS within the voice channel itself, without redirecting them to payment links (pay by link) or interrupting the conversation.
The result is a safer, PCI DSS-compliant telephone payment, with less friction and stronger protection against fraudulent chargebacks. It is not just about protecting card data, but also about verifying who is authorising the payment.
PCIaaS + PBC 3DS = ATO, turning the telephone channel into a secure, authenticated environment eligible for liability shift and ready for the future of Secure Agentic Voice Commerce.