In the world of Secure IVR Payments, few topics create more confusion than the role of the Session Border Controller, or SBC.
For some people, the idea seems simple: if a payment is taken over the phone, an SBC must always be part of the architecture. But that is not the right way to look at it.
The real question is not whether an architecture includes an SBC. The real question is whether card data is properly isolated, whether exposure is minimized, and whether the voice payment flow is protected wherever payment data is stored, processed, or transmitted. PCI DSS was created as a baseline of technical and operational requirements designed to protect payment account data, and PCI SSC’s guidance for telephone-based card payments makes clear that the standard applies across payment-acceptance channels, including mail order / telephone order environments.
That distinction matters.
Because a Secure IVR Payments architecture can be well designed, PCI DSS aligned, and operationally robust without making an SBC a universal requirement. At the same time, there are organizations for which an SBC can still play an important strategic role as an additional layer of segmentation, control, and defense in depth within the voice channel. PCI SSC’s telephone payment guidance is explicit that it is supplemental guidance and does not add, replace, or supersede PCI DSS requirements.
What PCI SSC Actually Says About IVR Payments
A good starting point is the official PCI SSC guidance on telephone-based payment card data.
That document explains that PCI DSS requirements apply to payment card data throughout the transaction lifecycle and across all payment acceptance channels, including MOTO environments. It also clarifies that the guidance itself is supplementary: it helps organizations interpret voice-payment scenarios, but it does not impose a specific technology stack or declare that one component must always be present in every implementation.
This is the first key point for any serious discussion about SBCs in voice payments:
PCI SSC does not establish an SBC as a universal requirement for secure IVR payments.
What PCI SSC does establish is that PCI DSS applies wherever payment card data is stored, processed, or transmitted. And when VoIP traffic carrying card data travels within the entity’s own infrastructure, that environment can fall within PCI DSS scope and must be protected accordingly. The guidance also explains that systems redirecting cardholder data, or transmitting that data across public networks, require particular attention and strong protection measures.
That is a much more precise and technically accurate way to frame the issue.
The Real Security Question: Where Does the Card Data Go?
Too many conversations about security become conversations about equipment.
But in practice, what matters most is data exposure.
If cardholder data is heard by the agent, captured in call recordings, exposed to contact center desktops, or carried across internal systems that were never meant to handle payment data, the organization’s risk and compliance burden increase dramatically.
On the other hand, if the payment flow is designed so that the customer enters the card data directly into a secure IVR environment, and the agent, the recording platform, and the wider contact center stack never have access to that data, the architecture changes completely. The security model becomes cleaner, the PCI footprint can be reduced, and the operational risk profile improves significantly. Pay by Call describes its platform in exactly these terms on its website: the customer enters card data directly into a secure IVR layer, with no exposure to agents or recordings, and cardholder data stays inside the Pay by Call platform.
That is why the right question is never simply, “Do we have an SBC?”
The right question is, “Have we built the voice payment flow so that sensitive card data is isolated from the contact center environment and handled only inside a secure, compliant architecture?”
When an SBC Is Not Necessary
In many projects, the answer is yes.
If the IVR payment architecture is properly designed, an SBC does not need to be treated as a mandatory universal component.
A payment-by-phone solution can already achieve a very high level of security if it is built around a few core principles:
- Card data is entered directly by the customer into a secure payment environment.
- Agents never see or hear sensitive authentication or card data.
- Call recordings do not capture payment data.
- The payment flow is handled inside a secure and compliant platform designed for that purpose.
This is entirely consistent with PCI SSC’s guidance, which focuses on protecting cardholder data where it is present, rather than prescribing a one-size-fits-all architecture.
In other words, a voice payment solution does not become secure because it contains more components. It becomes secure because it removes unnecessary exposure and protects the payment path where the sensitive data actually exists.
That is an important distinction for contact centers, BPOs, utilities, public administrations, and any organization evaluating modern voice payment security.
When an SBC Can Add Real Value
Saying that an SBC is not universally required is not the same as saying it has no value.
It can have significant value in the right context.
An SBC can make sense when a customer wants to reinforce the voice layer with stronger perimeter control, session governance, segmentation, and technical supervision. In these cases, the SBC is not being added because PCI SSC forces every IVR payment architecture to include one. It is being added because the organization wants a more controlled and hardened voice perimeter.
This is especially relevant for enterprises with mature security cultures, internal policies that demand additional segmentation, or a corporate preference for defense-in-depth models. For those organizations, an SBC can be seen as an architectural enhancement that adds control and visibility to the voice channel.
That is the second key point:
An SBC is not necessarily a baseline requirement, but it can be a strategic decision.
And for some enterprises, that difference matters a great deal.
Pay by Call’s Approach: Isolate the Data First
Pay by Call’s approach begins with a very clear principle: secure the telephone payment by isolating the sensitive card data from the contact center environment.
On its English website, Pay by Call explains that its platform turns phone lines into a PCI DSS secure payment channel through a secure IVR layer where the customer enters payment data directly, without exposure to agents or recordings. The same page also states that this allows cardholder data to remain within the Pay by Call platform and helps remove the contact center from PCI DSS scope for that part of the process.
That positioning is important because it reflects the strongest logic in secure voice payments: do not try to protect exposed card data after the fact if you can avoid exposing it in the first place.
This is also why the discussion around SBCs should come after the discussion around architecture, not before it.
First, isolate the data.
Then, assess whether the customer also wants to reinforce the voice perimeter further.
Beyond PCI DSS: Why Security Positioning Also Matters
Enterprise buyers often evaluate more than payment compliance alone.
They also want evidence of operational maturity, resilience, governance, and institutional-grade controls.
This is where Pay by Call’s broader positioning becomes relevant.
According to Pay by Call’s website, the company combines its PCI DSS security posture with additional elements such as ENS High Category, Google Cloud Platform, and telecom-operator positioning.
The ENS, or National Security Framework, is described by the Spanish National Cryptologic Centre as a common framework of basic principles, requirements, and security measures for the protection of information and services, with the objective of ensuring access, confidentiality, integrity, traceability, authenticity, availability, and conservation of data and electronic services. That makes it particularly relevant for high-criticality and public-sector environments, and for suppliers working with those environments.
This does not mean “absolute invulnerability,” and serious security professionals should avoid that kind of language. What it does mean is that the security narrative goes beyond simple payment compliance and into a broader model of high-assurance service protection, governance, and continuity.
Google Cloud Platform as an Additional Layer of Resilience
A secure payment architecture is not only about keeping data isolated. It is also about making sure the platform is robust, resilient, and designed to continue operating under demanding conditions.
Google Cloud’s own architecture guidance defines reliability as the ability of a system to consistently perform its intended functions and maintain uninterrupted service. Its reliability best practices include redundancy, fault-tolerant design, monitoring, and automated recovery processes. Google Cloud also states that its infrastructure is designed to tolerate and recover from failures, and it documents approaches for building highly available systems through resource redundancy.
This matters because when a secure voice-payment platform is hosted on Google Cloud Platform, the value proposition is not only about compliance. It also includes architectural resilience, scalability, and continuity of service over enterprise-grade cloud infrastructure. Pay by Call identifies Google Cloud as part of its platform positioning on its website, which strengthens that broader message.
For organizations that process critical inbound collections, regulated payments, or high-volume contact center transactions, resilience is not a secondary feature. It is part of the core security and business continuity conversation.
The Enterprise View: Compliance Is the Starting Point, Not the End Point
For some organizations, PCI DSS alignment is enough.
For others, it is only the starting point.
There are enterprises for which security is not just a regulatory requirement. It is a board-level decision, a procurement criterion, and a corporate design principle. These organizations often prefer layered models that combine payment compliance, infrastructure resilience, operational traceability, and reinforced control over the communications path.
This is exactly the context in which an SBC can move from “optional component” to “strategic architectural choice.”
Not because PCI SSC says every secure telephone payment needs one.
But because the customer wants stronger perimeter control in the voice layer as part of a broader enterprise security model.
A Better Way to Explain SBC in Voice Payments
The market often frames the SBC question too simplistically.
A better explanation is this:
- PCI SSC does not make an SBC a universal requirement for telephone payments.
- PCI DSS does apply wherever payment data is stored, processed, or transmitted, including relevant parts of a VoIP environment carrying card data inside the entity’s infrastructure.
- A well-designed secure IVR payment architecture can already deliver strong PCI DSS-aligned protection without forcing every project to adopt an SBC.
- For organizations that see security as a strategic corporate decision, an SBC can still add value as an optional reinforcement layer in the voice channel.
That is the balanced, technically credible position.
And it is also the position that best supports serious enterprise conversations.
Conclusion
The real purpose of a secure telephone payment architecture is not to accumulate components. It is to protect cardholder data with the right design.
That starts with data isolation.
It continues with PCI DSS-aligned processing.
And for some organizations, it extends into a broader strategy of resilience, governance, and defense in depth.
That is why the SBC discussion should be handled carefully.
An SBC is not a universal requirement imposed by PCI SSC for all telephone payment environments. But it can absolutely be a smart strategic choice for organizations that want to reinforce control, segmentation, and protection in the voice channel.
Pay by Call’s positioning is built around that distinction: secure IVR-based PCI DSS telephone payments with full isolation of sensitive card data as the foundation; and, where required, a reinforced architecture supported by a broader security and resilience story that includes ENS High Category, Google Cloud Platform, and telecom-operator capability.
For organizations that want to evaluate whether a standard secure IVR model is enough, or whether an additional SBC layer makes sense for their environment, the right answer is not ideological. It is architectural.
And that is exactly where Pay by Call can add value.
Want to assess whether your voice-payment architecture needs only a secure PCI DSS IVR layer or a reinforced SBC-based design? Contact Pay by Call and we will review your use case.