21–30 of 32 posts
This is very cool. One problem I see though is that most phone payment transactions happen over a regular phone call vs a dedicated session started over some IVR system. It would be very cool for businesses to be able to, say, have a payment bot join the call and then leave once the transaction is done.
For example, when I key in my card number, my phone carrier will know it, the routing carriers know it before it reaches Twilio. How is my card information safe? I guess I'm missing something here.
I don't completely understand how they do this without exposing the DTMF tones / digits pressed to the carriers. For example, when I key in my card number, my phone carrier will know it, the routing carriers know it before it reaches Twilio. How is my card information safe? I guess I'm missing something here.
Earlier quoted context omitted.
Interestingly, this might be in response to the new PCI requirements. In the past, if you iframe'd a payment processor site, you didn't need to be PCI compliant while the new spec requires everyone who is involved in the process to be compliant. I wonder if this will be the future of payment processing, just outsourcing to Twilio and Stripe.
I've heard rumors about new PCI requirements for service providers mandating end to end encryption of phone calls with credit card data. This would certainly be an off the shelf solution
I don't completely understand how they do this without exposing the DTMF tones / digits pressed to the carriers. For example, when I key in my card number, my phone carrier will know it, the routing carriers know it before it reaches Twilio. How is my card information safe? I guess I'm missing something here.
I don't completely understand how they do this without exposing the DTMF tones / digits pressed to the carriers. For example, when I key in my card number, my phone carrier will know it, the routing carriers know it before it reaches Twilio. How is my card information safe? I guess I'm missing something here.
DTMF is being pulled out of band by Twilio (or more likely the underlying CLECs they partner with), thus the agent should not hear it. This is very common for most VOIP carriers, DTMF is carried in the signaling messages rather than in-band in the audio stream. The only person being protected from having access to your card data is the agent who asked you to key in your card.
So, if attackers wants to get card details, they need not attack the business or Twilio (because it might redact these when they see , but they can simply access logs of the middlemen for DTMFs. Concatenate all those per call, and there we should have all card numbers, expiry dates and CVC/4DBC.
Not sure how Twilio is doing it though. Unless they use some awesome encryption method to encrypt all these numbers so no one in middle can see them.
I don't completely understand how they do this without exposing the DTMF tones / digits pressed to the carriers. For example, when I key in my card number, my phone carrier will know it, the routing carriers know it before it reaches Twilio. How is my card information safe? I guess I'm missing something here.
PCI doesn't currently consider telephones to be public networks. That's why they are okay with fax machines sending CC details, provided they are in a secure area and a few other non tech requirements. Not sure I agree with the practice, but it is what it is.
Does Stripe have payment links like Razorpay [1] ? [1] https://razorpay.com/payment-links/
Alternatively, I built https://checkoutpage.co to create hosted payment pages for Stripe that are accessible by url, similar to Razorpay's payment links.
It’s not 100% clear from the documentation but it appears the card details have to be keyed in and there’s no voice recognition mode. It would be great to hear a demo of what sounds like, particularly the error handling. I absolutely get the benefit of insulating your agents from the billing data. Not so keen on an abrupt switch to touch-tone inputs during a call though.
From the linked post: "when it’s time to collect the payment, the agent activates Twilio to let the customer enter payment info using their keypad—agents can follow the customer’s progress, but won’t see or hear the card details."
I recently pay my home insurance's renewal that way (Europe).
However, these days many systems use voice recognition rather than having to key in numbers. I'm guessing that this is on Twilio's roadmap.
I don't completely understand how they do this without exposing the DTMF tones / digits pressed to the carriers. For example, when I key in my card number, my phone carrier will know it, the routing carriers know it before it reaches Twilio. How is my card information safe? I guess I'm missing something here.
Why would they be receiving the tones once the connection is made? Isn't it the same as me just whistling at particular frequencies? I didn't think it was sent in a different manner.
Or do you mean it goes through the carrier just like if you spoke your card number over the phone to someone?