How to redact card numbers and personal details from call audio

Card numbers turn up in call recordings more often than most contact center leaders expect. Agents forget to pause the recording, callers read the number before being asked, or a payment line was never set up for pause-and-resume in the first place. Before any part of an archive is considered for a license, those numbers and the other personal details around them have to go.

Why redact before a buyer de-identifies?

Buyers describe their own de-identification. Scale AI describes stripping identities while the data still sits on the seller’s systems. micro1 describes de-identifying and transforming sensitive material on its side. Both help as a backstop; neither justifies shipping raw recordings out of the building. Redacting first keeps card data and personal details inside your own systems, where your controls apply.

There is also a standards reason. Recordings that capture spoken card data are in scope for the payment card industry’s data security standard, PCI DSS. It does not allow sensitive authentication data, such as the card security code, to be stored after authorization, even in encrypted form. The PCI Security Standards Council publishes separate guidance on protecting telephone-based payment card data. An archive with card numbers in it needs cleaning whether or not it is ever licensed.

What has to come out?

Card data is the obvious category, but it is not the only one.

Category	Examples	Where it hides
Payment data	Card number, expiry date, security code	Payment queues, collections, renewals
Account identifiers	Account and policy numbers, order IDs	Opening of most calls
Government IDs	Social Security number, driver’s license	Identity checks
Contact details	Name, address, email, phone number	Throughout, often spelled out
Security answers	Mother’s maiden name, first pet	Verification steps
Health details	Anything a caller says about their health	Unpredictable; any queue

Health details deserve a strict rule: remove them wherever they appear, and if a queue routinely involves them, leave that queue out entirely.

Which steps work, and in what order?

1. Transcribe with word-level timestamps. Redaction depends on knowing exactly when each word was spoken. If your platform recorded agent and caller on separate channels, transcribe them separately; it makes detection more accurate.
2. Detect in the text. Combine pattern rules (runs of digits that pass a card checksum, date formats, email shapes) with entity detection for names and addresses. Watch for digits spoken in groups (“four one one one”), numbers corrected mid-sentence and details spelled letter by letter.
3. Silence the audio spans. Replace each detected span with silence or a flat tone, with a short margin before and after. Bleeping individual digits can leave fragments audible; covering the whole span is safer.
4. Tokenize the transcript. Replace the same words with a typed token such as CARD_NUMBER or CALLER_NAME, so the text keeps its structure without the content.
5. Scrub metadata and file names. Phone numbers, account IDs and agent names often sit in file names, folder paths and database fields. Replace them with random tokens and keep the key separately, or drop them.
6. Check a sample by ear. Listen to a random sample from every queue and every year. Decide in advance what failure rate sends a set of calls back for another pass.

What about voices?

Silencing a card number does nothing about the voice saying it. If the buyer only needs the words, a redacted transcript carries no voiceprint and avoids the biometric question. If it needs audio, read up on voiceprints and biometric laws and ask the buyer whether it can work with speaker-anonymized audio.

How do you prove the redaction worked?

Keep a short log: the scope (queues, years and caller states included), the method and tools, the categories removed, the sample size and misses found, and who signed off on release. A buyer’s lawyer will ask for it, and so should yours. The redacting call audio page has a template for the log fields.

How long does it take?

Longer than the transcription. Detection rules need tuning for each line of business, because a collections queue and a technical support queue fail in different ways. Budget for at least two passes: the first finds the patterns your rules miss, the second confirms the fixes. Large archives are usually redacted in slices by queue and year, so a problem found in one slice does not hold up the rest, and so the sample checks stay meaningful.

Common mistakes

• Redacting the transcript but not the audio, or the reverse.
• Trusting automatic detection without a listening check.
• Forgetting the opening of the call, where account numbers are often read out.
• Leaving phone numbers in file names after cleaning the audio.
• Treating pause-and-resume as evidence that no card data was recorded.

Redaction is the slowest part of preparing an archive, and the part most worth doing well. For the order of the other checks, start with the main briefing on how to sell call recordings. A clean archive is a smaller archive, and that is the point.