PCI DSS, Telephone Payments, and the Problems With VoIP

Merchants accepting telephone payments over VoIP are generally ineligible for SAQ C-VT and P2PE because PCI SSC guidance treats VoIP traffic containing cardholder data as in-scope network traffic; the article explains the interpretation and sources, the impact on SAQ eligibility, mitigation options (stop phone payments, revert to POTS, outsource to achieve SAQ A, switch to SAQ B/B-IP/C, or apply full SAQ D), and offers practical QSA commentary and recommendations for remediation.