DTMF Masking: What It Is, Who Sells It, and What It Costs

The four vendors you will hear named most are PCI Pal, Sycurio, Eckoh, and Key IVR.

Two of them publish a price. PCI Pal's starts at £25.50 per named user a month, about $35. Eckoh lists a bundle of 100 licenses for $36,000 a year, so its minimum is 100 agents. Every masking price on this page is in pounds, from a UK government filing, because that is the only price any of the four has put its name to. Treat it as a floor and ask for a US quote.

I ran a support desk that took 5,000 calls a week, and customers read us their card numbers all day. My company now cleans call recordings for teams that take payments by phone, more than 2 million recordings so far.

We sell post-call removal, not DTMF masking. The number reaches the recording, and we take it out a few minutes later.

The lowest DTMF masking price we could find in public is £25.50 per named user a month, with a minimum of ten users, a £3,950 setup fee, and a £3,300 fee to connect it to your card processor. PCI Pal filed it on G-Cloud, the UK government's buying catalog.

PCI Pal, G-Cloud 14 pricing document, May 2024

What it would cost a team of 20 agents

The numbers below use the only published prices and our own arithmetic, so your quote will differ. The last column uses the words of the PCI Council's phone-payment guide, quoted further down, not a promise about what your auditor will accept.

Option	Year one, 20 agents	Time to go live	What you can tell your processor
DTMF masking	About $18,200 on PCI Pal's UK rate card: 20 users at £25.50 a month, plus £7,250 in one-off fees. Eckoh sells 100 licenses at a time for $36,000.	PCI Pal says training and testing fit in one day. Key IVR says a few weeks.	Card numbers never reach the phone system or the recordings, once you verify that. The guide says this can take the agents and the recordings out of scope, which means the auditor stops asking about them.
Pause and resume	No software cost if your phone system has a pause button. Budget about an hour a week for one person to check recordings.	Same day, if your phone system has the button.	Agents pause the recording while the number is read, and someone checks recordings every week. The agent still hears the number.
Remove it after the call	$2,160: 20 agents at $9 a month. This is what we sell.	About a minute to install. The first clean recording posts minutes after the next call.	The security code and card number come out of every recording minutes after the call, and the original is deleted.

What DTMF masking does to the call

Each phone key makes its own tone. DTMF, short for dual-tone multi-frequency, is the name for those tones.

The card industry's security rules are called PCI DSS, short for Payment Card Industry Data Security Standard. Your payment processor holds you to them. The PCI Security Standards Council, which writes them, publishes a guide to phone payments called Protecting Telephone-Based Payment Card Data (version 3.0, November 2018). I'll call it the phone guide.

It warns that a trained ear can pick a number out of keypad tones. A recording of the keypad tones holds the card number.

The phone guide separates two things that usually get one name:

"DTMF suppression is removing these tones, DTMF masking is replacing the tones by either a random tone or a flat tone."

On the call, the agent asks the customer to type the card number instead of saying it. The agent, in the guide's words, "often hears only a single repetitive tone." The guide also calls this "clamping," and you will hear that word on a vendor call. The expiry date and security code go in the same way. PCI Pal calls its product Agent Assist, and Key IVR calls its Agent Assisted Payments.

As the digits arrive, the agent's screen shows asterisks, "perhaps only displaying the last four digits." The agent can still tell the customer when the payment goes through.

The fake tone "must not be linked" to the real one, so nobody can work backward from the sound to the digit. You have to check that your recordings hold only flat tones. If the real tones are still in the file, the guide says the card number "can be recovered." That recording then counts as card data you have to protect.

What it costs and what you sign

Every figure below comes from a document the vendor filed or a page the vendor wrote. Where we found nothing, the cell says so. Dollar figures in parentheses are our rounding at £1 = $1.36, the rate on August 22, 2026.

Vendor	What it costs	Contract and minimum
PCI Pal	£25.50 (about $35) per named user a month on its G-Cloud 14 rate card. A named user is one person you put on the account. Setup fees are extra.	"Licences typically run for an initial 12-month term with automatic renewal for subsequent years." Minimum ten users. Over 700 customers, by its own count.
Sycurio	Not published. Its site has no pricing page.	Not published. Its Talkdesk page says to "speak to an expert" about pricing and contracts. It sells to enterprises, in its own words.
Eckoh	$36,000 a year for a bundle of 100 CallGuard licenses on AWS Marketplace. That is $30 a license a month, by our arithmetic.	The AWS listing is 12 months. Its published wins run two, three, and five years. The smallest bundle listed is 100 licenses, and the smallest deployment it names is about 100 agents.
Key IVR	Not published, and not per agent. "You don't need licences for everyone, only based on how many payments you're taking at any one time."	Not published. Setup "can be completed within a few weeks." No minimum agent count published. Over 250 clients, by its own count.

Your bill starts at the minimum seat count, not at the per-seat price. PCI Pal's minimum is ten users, so the smallest license bill is £255 a month (about $350). Its rate card adds a £3,950 setup fee and a £3,300 payment gateway fee, both one-time. The gateway fee connects their system to your card processor. PCI Pal says it works with "a wide range of payment gateways," so ask whether yours is on the list before you sign. That puts the smallest deployment at £10,310 in year one (about $14,000), by our arithmetic.

You sign for a year at a minimum, and Eckoh's public contract wins run two to five years.

G-Cloud is a UK public-sector filing from May 2024, so PCI Pal may quote a US buyer another price. We print it because it is the only per-seat price any of these four vendors publishes.

Does it work with Zendesk Talk?

Zendesk Talk is the phone system built into Zendesk. If your agents take calls from inside a Zendesk ticket, you have it.

None of the four publishes a Zendesk Talk integration on its own website. One may still exist, and we could not confirm it either way. We read each vendor's integrations page and partner list, and searched their published results and press pages, on August 22, 2026.

Their lists point at contact center platforms like Genesys, Five9, and Amazon Connect. Those platforms let a vendor sit inside the live call, and that is the only place you can stop the digits before they reach the recording.

Key IVR is the only one that lists Zendesk at all. The Zendesk tile opens a page with no description on it, while its phone system integrations each get a written page. The words "Zendesk Talk" do not appear on any Key IVR page we read.

We did not search the Zendesk Marketplace listing by listing. Our Zendesk Talk review covers what Talk records and where that file goes. If a vendor tells you it supports Talk, ask to see it on a Talk call.

The calls the keypad does not cover

DTMF masking only cleans the recording on the calls where the customer uses the keypad. The phone guide's entry for masking has a condition attached. In the quote, CHD is the card number and SAD is the security code and the other data you are never allowed to keep:

"Recordings will not capture CHD or SAD if DTMF masking/suppression is implemented prior to the data reaching recording systems (when DTMF is the only acceptance channel)."

The keypad is not always the only way to pay. The guide says why:

"Those using DTMF masking/suppression for their telephone payments may also be required to accept some telephone payments verbally to support customers with disabilities or who are otherwise unable to pay by pressing their telephone keypad."

Those calls are recorded too. If you take payments that way, the guide says you have to protect the spoken number. It says you have to "remove all SAD upon completion of the transaction."

The vendors say so themselves. PCI Pal offers "Speech Recognition for customers who can not use their telephone keypad." Eckoh's CallGuard takes the card "using their phone keypad or by speaking them aloud." Questions to ask the vendor:

• "What happens to the recording when a customer reads the card number out loud instead of typing it?"
• "How do I check that my recordings hold only flat tones, and how often?"
• "What happens to the card data if the masking fails mid-call?"

The third is the guide's own question, in our words. We can only speak for lines with no masking on them. Our own numbers: across about 2.1 million recordings we processed, about one call in six had a spoken card number, expiration date, or security code in it.

A masking system has to detect a tone before it can mask it, and the guide warns that "the initial portion of the DTMF tones may not be masked." The guide calls this DTMF bleed and recommends "a regular review of the signal." That means someone listens to recordings and checks whether any digits got through.

Three ways to satisfy the rule

The phone guide says the security code cannot stay in the recording, and you have to make the card number unreadable wherever it sits. We quoted the rule in full in what the rules say about your recordings.

This is the table I wanted before my first vendor call.

Approach	How it works	The catch
Keep the number off the call	The customer types the card on their phone keypad and the vendor's system masks the tones. Or they pay on a link you text them. Nothing is spoken.	Payment moves to a separate system, and the customer has to change how they pay. The calls where a customer cannot use the keypad still need a way to keep the number out of the recording.
Pause and resume	The recording stops while the number is read, then restarts.	It depends on a person remembering, every call, and on someone checking the recordings afterward. The agent still hears the number.
Remove it after the call	The call happens normally. A tool finds the card number, removes it from the audio and the transcript, and deletes the original.	The number does reach the recording. It has to come out on every call, and you have to prove it did.

DTMF masking is the only one of the three where the number never reaches your systems. The guide says that if it is set up right, masking "can take not only the telephony environment, but also the agent environment and CRM system out of scope." Out of scope means the auditor stops asking about those systems.

If your auditor wants that, and your customers will use the keypad, buy it. Check the minimums above before you call: PCI Pal ten users, Eckoh a 100-license bundle, Key IVR none published.

Pause and resume suits a small team where one person already checks the recordings every week. Pull a few payment calls each week, listen to the payment part, and log who listened and when.

Removing the number after the call is what we sell. The audio gets stored, so the card data has to come out of it. The guide says the security code "MUST BE DELETED from the recording as soon as the transaction is processed."

I'm not going to pretend it's the same as never recording the number. The number exists in the file for a few minutes. Nobody has to remember anything, and nobody has to change how they pay.

The tool we sell

CallTutor is our product, so read this part as a sales pitch and check it yourself.

$9 per Talk agent. No contract. You pay for each Zendesk Talk agent who takes card calls, so you can sign up with one agent.

The app picks up each recording after the call ends, finds the spoken card numbers, and removes them from the audio and the transcript. Redacted audio and transcript post to your ticket, the original recording is deleted from Zendesk, and transcripts are cleared from our database. That happens minutes after hangup. Agents don't have to do anything different.

$9 sounds too cheap to be real next to the prices above. It is cheap because it never touches the live call. See it on a real call, before and after, or go straight to the setup guide, which starts with a marketplace install and takes about a minute.

Frequently asked questions

What is DTMF suppression, and is it the same as masking? They are not the same thing. The phone guide says suppression removes the keypad tones and masking replaces them with a flat or random tone. In vendor marketing the two words get used for the same product, and either way the card number is not in your recording.

What is agent assisted payment? It is the vendors' name for DTMF masking with the agent still on the line. The phone guide calls this an attended payment, "where the entity remains in direct voice contact with its customer for the entire duration of the telephone payment transaction." The unattended kind hands the customer to an automated menu for the card entry, and the agent comes back after.

Is DTMF masking required for PCI compliance? No, and the phone guide names three outcomes for recordings. Masking keeps the recording clean when the keypad is the only way to pay. Pause and resume may capture the number, and a spoken number sits in the recording as plain audio.

If the card data gets recorded anyway, PCI DSS says to delete the security code right after the transaction. You also have to make the card number unreadable. Masking is one way to meet that. Our guide to the rules for call centers covers the other two.

What happens if the customer will not use the keypad? The customer reads the number out loud, and the recording captures it. The phone guide says you may be required to take those payments. It also says you then have to protect the spoken data and remove the security code afterward. Ask the vendor what its product does on that call, and what you have to do to the recording.

Can I use DTMF masking with Zendesk Talk? None of the four vendors listed a Zendesk Talk integration when we checked in August 2026. See the Zendesk Talk section above for what we checked and what to ask.

What does DTMF mean in insurance? DTMF means the same thing in insurance that it means anywhere else. Insurers ask about it because they take card payments by phone and they get audited.

---

Sources: PCI Security Standards Council, Protecting Telephone-Based Payment Card Data, version 3.0, November 2018; PCI Pal, G-Cloud 14 pricing document, May 2024 and FY25 preliminary results; Eckoh, AWS Marketplace listing and FY24 results; Sycurio, integrations; Key IVR, contact centre solutions and Zendesk integration page. We checked every vendor page on August 22, 2026. Prices are printed as filed, in the currency filed. Dollar figures in parentheses use £1 = $1.36, the rate on August 22, 2026, and are rounded. Our own arithmetic is labeled as ours. The Zendesk Marketplace was not searched, so the integration findings rest on what each vendor publishes. The call statistics combine all our customers, and we do not disclose any one customer's data. This is not legal advice. The cover photo is an illustration we generated, not a real customer.