Background
Great Places Housing Group owns and manages more than 18,000 homes across the North West and Yorkshire region and is one of the largest developing housing associations in the North of England.
allpay has been providing payment solutions to Great Places Housing Group since 2009, and now collects nearly £23 million per annum across more than 300,000 transactions through its direct debit service, Post Office and PayPoint services and its range of debit/credit card acceptance solutions. These include: online, automated phone, text, mobile payment app and virtual terminal Callpay – the latter allowing its staff to process payments over the phone.
allpay provides the solutions through the Consortium Procurement framework, after being awarded sole supplier status on the framework in 2015.
The challenge
In November 2016, following an external compliance review of its payment services, the group sought a secure method of transacting card payments over the phone that descoped its whole contact centre from Payment Card Industry Data Security Standard (PCI DSS). As the group recorded all of its calls, it operated a ‘pause and resume’-based solution, which saw agents manually pause the recording while taking a card payment through allpay’s virtual terminal, Callpay, preventing customer details from being recorded. Latest revisions of the PCI DSS standards have tightened security requirements, making the previous solution increasingly unwieldy to control and inflexible to operate. With up to eight agents potentially taking payments at any one time, Great Places sought an automated solution capable of meeting current and new regulatory requirements as they develop in the future.
The solution
Following a review of the market, the group procured allpay’s DTMF tone masking solution, which removed desktops, IT and telephony systems, agents and call recordings from PCI DSS compliance scope and required Great Places’ customers to type their card numbers into the telephone keypad, rather than speaking them aloud to an agent. allpay provides the solution as part of its exclusive reseller agreement with PCI DSS compliant contact centre solutions provider Eckoh. In addition to being competitively priced, the solution is already integrated with allpay’s virtual terminal, Callpay – which the group was already utilising. This removed any additional software and payment file integration and provided the solution within a cloudbased environment that its agents were already familiar with. Additionally, as allpay had already reviewed the market as part of its due diligence in selecting Eckoh, this saved up to two months’ worth of procurement and due diligence that would have to have been undertaken by Great Places.
Mike Hughes said:
“We looked at half-a-dozen providers, but with the integration benefits allpay could provide, the assurance that it and Eckoh offered, and that we would receive payments within the daily allpay files as we currently do now – we went with allpay. Some of the other providers also required the group to be doing a certain volume of transactions, but allpay was flexible with its approach.”
The solution enables constant conversation with Great Places’ agents while the payment is being processed. When the card numbers are entered on the keypad, each digit is replaced on the line by a flat tone which makes the number anonymous to the agent/call recording software. Unlike the ‘pause and resume’ method, this allows the call and the recording to take place uninterrupted. The system offers enhanced security to all areas of the contact centre, as the agent will only see the first six digits and last four digits of the card number on screen, with the middle digits masked (see below). This allows the Callpay solution to provide a real-time validation of the card details on screen; with the ability to ask the customer to re-key details if they are mis-keyed.
Training and Implementation
Mike Hughes said: “The training provided was comprehensive and the videos allpay provided were great. We were then able to train all staff taking payments in around an hour. As a result of the solution being integrated into the Callpay system that staff already use, it was very straightforward. There’s an additional window that opens within Callpay during the payment process and the feedback from staff is that it is intuitive and easy to use. We also appreciated the onsite assistance allpay provided before and after go-live. In total the implementation was around three to four weeks.”
Neil Higham, Director of Business Systems at Great Places, added:
“The whole implementation has gone really smoothly and much quicker than we originally thought it might be. The fact that the integration was already there and we already processed payments using allpay made it easier, but it was nice to have such good feedback about how proactive and professional allpay had been.”
The Benefits
As a result of the implementation, allpay has completely removed Great Places’ contact centre from the PCI DSS audit scope and has significantly reduced the risk of fraud and data breach – which was the group’s primary objective. This allows the group to comply with PCI DSS through completion of SAQ-A only, dramatically reducing its compliance requirements. When ringing the automated phone line, Great Places’ customers have the option to make an automated phone payment, via allpay’s 0330 IVR line, or to be put through to one of Great Places’ agents for the payment to be securely processed by its staff utilising Callpay’s DTMF tone masking functionality.
Mike Hughes:
“The solution from allpay eliminated the need to carry out a major upgrade of our system which would have required significant capital and ongoing investment, the annual completion of rigorous PCI compliance forms, additional encryption and ongoing maintenance. We estimated this alone would have doubled our investment costs from the solution we procured from allpay and would have been an annual project to ensure compliance. Additionally, it would have been our responsibility. The benefit of outsourcing the solution to allpay is that it has completely removed Great Places’ contact centre from the PCI DSS audit scope and has significantly reduced the risk of fraud and data breach which could result in a heavy fine. We communicated the solution to customers on the basis that they are entering their card information and that we don’t see, hear or store it, so increases the security of the payment. There are around 13 agents that utilise the service and take payments from customers across multiple sites. The feedback and results have been really positive. There have been no issues since go-live, including on our peak day at the end of the month where we take approximately £150,000 in rent payments. As a result of also implementing allpay’s 0330 IVR line, we are seeing a cost saving from the previous 0844 line and reducing the number of calls coming through to our agents.”