Patent Description:
Call centres are typically large facilities of telephone operators or 'agents'. These centres are provided by organizations that want to interact with existing or prospective clients and customers. A call centre agent normally interacts with a client or customer by taking or making telephone calls. It is common practice for the call centres to record client conversations, and for information taken during the call to be entered into and stored in the agent's computer.

One use of call centres is to provide services to the public that allow payment for goods and services via telephone calls. Each year, millions of people make purchases through agents in telephone call centres, often including high value transactions. For example, family holidays and financial products are often purchased over the telephone. In these transactions, the caller is required by the agent to provide certain pieces of sensitive information in order to confirm his or her identity and/or to complete the purchase. In particular, the sensitive information can include one or more answers to security questions, a password, a date of birth, one or more bank account numbers, and debit or credit card details including the primary account number (PAN), start date, expiry date, and the card security code (e.g. CV2).

It is an unfortunate fact of life that wherever people have access to sensitive information, it will be misused. Data and card fraud perpetrated by call centre agents, as well as fraudulent financial transactions are well-documented problems that need to be addressed. By divulging identity and/or financial information to an agent for processing a transaction through a call centre, a caller puts themselves at risk of having that information stolen by the agent and used for nefarious purposes. Other threats exist from hackers gaining access to an agent's computer or a call centre network, or eavesdroppers intercepting a call to an agent. Thus, data stored in call recordings, or sent by a caller to an agent may also be at risk from theft by third parties. In order for the industry to flourish, it is essential that clients and customers calling a call centre are able to trust that their sensitive information is not at risk.

To address card fraud, the payment card industry established a number of data security standards. One example is the Payment Card Industry (PCI) Data Security Standard (DSS) which provides periodically updated guidelines for the processing and storage of credit card data. In particular, the PCI-DSS specifies the ways in which companies that handle credit card data (including telephone-based credit card transactions) are permitted to store information. All merchants, globally, are expected to comply with the PCI-DSS, and so these regulations have a direct impact on call centres that receive sensitive information during telephone calls.

Several known systems exist to allow call centre agents to take debit or credit card payments over the phone without the caller having to read out sensitive card details (e.g. primary account number (PAN), start date, expiry date, the card security code (e.g. CV2) to the agent directly. These systems typically require the caller to enter the card details using 'touch-tone' keypad, which encodes the details using dual-tone multi-frequency (DTMF) signalling. DTMF has been established for decades and, as would be familiar to a skilled person, can be used to communicate alphanumeric characters through a telephone audio channel during a phone call. The DTMF tones used to encode the caller's card details can then be decoded by a call processor and transmitted to a payment processing system.

DTMF offers a basic level of security that represents a significant improvement over a caller speaking his or her card details to the agent. However, it is a long way from assuring customers that their sensitive information is not at risk. DTMF is easily decoded by conventional and readily available systems. Accordingly, a determined agent or third party would even be able to steal card details transmitted by DTMF, simply by obtaining or copying the signal that is recorded and stored by the call centre and then by employing a DTMF decoder offline to reveal the digits. Thus, the use of DTMF alone was quickly found to be insufficient for establishing a robust data security system.

There is an exemplary DTMF system of the kind described above that is particularly convenient to implement, and also provides improved security for the user. It just so happens that the equipment used to process phone signals with DTMF tones is routinely required when converting a phone signal from TDM (Time Division Multiplex) to VoIP (Voice over IP). TDM signals are conventional for telephony, but VoIP systems are often preferred because of their ability to implement high compression codecs to reduce the bandwidth requirement (and thereby to reduce network costs).

However, because the VoIP codecs are designed to optimise voice compression, they do not satisfactorily encode DTMF tones. This leads to erroneous decoding of the DTMF tones from VolP signals.

The Internet Engineering Task Force (IETF) document RFC-<NUM> describes a solution to the above-mentioned problem. This solution is known as 'DTMF clamping', and works by removing the in-band DTMF tones from the original signal and replacing them with an out-of-band data signal. By the early <NUM> many manufacturers of VolP gateways had commercialised a DTMF clamping function as a standard feature.

In recent years, owing to the prevalence of VolP gateways with DTMF clamping, a technician devising a PCI-DSS compliant system for call centre is provided with a straightforward solution: all that is required to prevent card details entered by a caller using a touch-tone keypad from reaching the agent is to situate a VolP gateway with DTMF clamping upstream of the agent. The card details would be provided by the VolP gateway as an out-of-band data signal, which could be transmitted to a payment processing system. <FIG> shows a representation of such a system, in which a call from a caller <NUM> is processed in a call processor <NUM> having a VolP gateway capable of DTMF clamping. The in-band DTMF tones representing the card details are replaced with an out-of-band data signal which is sent to a bank <NUM>. The voice signals are converted to VoIP and sent to the agent <NUM>.

However, there is a significant problem with DTMF clamping. Whilst clamping may mitigate theft of sensitive information transmitted using the tones, it also prevents them from being used for any other purpose. In particular, it is commonplace for call centres to use interactive voice response (IVR) systems, for example to enable a user to navigate through one or more menus using a 'touch-tone' keypad. DTMF clamping can prevents this functionality because the IVR system would be prevented from receiving the DTMF tones.

<CIT> discloses a solution that prevents theft of DTMF from recorded and stored signals whilst enabling use of an IVR system. A simplified representation of the solution is shown in <FIG>. The illustrated call processor <NUM> operates by splitting the incoming signal from the caller <NUM> into first and second versions 204a, 204b. One of the versions 204a of the incoming signal is directed to a call recorder <NUM> and is to be recorded and stored by the call centre. All DTMF tones are removed from this version 204a of the signal using conventional sensing and filtering techniques. Thus, the recorded and stored signal in the call recorder <NUM> lacks any tones representing sensitive information, which cannot thus be stolen. The other version 204b of the signal is sent to the agent <NUM> for processing as usual, and may be routed through an IVR <NUM>.

Although mitigating the risk of theft of sensitive information from recorded and stored signals, the solution disclosed in <CIT> still permits the agent to hear the DTMF tones. Thus, a particularly determined agent or third party may make his or her own recording of the DTMF tones for decoding offline. This has become more prevalent with the near ubiquity of digital recording devices such as smart phones, which would facilitate such a crime.

<CIT> proposes a refinement to the DTMF clamping technique. Faced with a situation in which DTMF tones must be transmitted some of the time (e.g. for IVR) but must not at others (i.e. to prevent theft by an agent), the refinement proposed by <CIT> is effectively to turn the DTMF clamping functionality on and off as necessary. Specifically, this document describes a telephone call processor with the capability to be switched between two modes: "normal" and "safe". In 'safe mode' any DTMF tones are removed from the original signal whilst the voice component is allowed to pass to the agent (to allow conversation between the caller and agent to be maintained at all times). 'Safe mode' is used when the caller is transmitting sensitive information. In 'normal mode' both the voice component and the DTMF tones are allowed to pass to the agent/IVR system.

<CIT> discloses systems and methods for preventing sensitive information from being communicated into a non-secure environment. A telecommunication system is arranged between a trusted automated interactive system and a non-secure agent. The trusted automated interactive portion is operable for bidirectional communications with a caller. The agent portion is arranged to be bridged onto a communication connection between the caller and the trusted interactive system under certain conditions. Sensitive data transmitted between the system and a calling user may be blocked from being communicated to the agent even while the agent is bridged onto the connection. In one example, the IVR is equipped to detect DTMF and when a detector "hears" the first tone on the line a mute control is enabled. In a different example, data can be prevented from passing to an agent until the sending user signals, by a special key stroke, that he/she is finished sending sensitive data.

However, all of the solutions devised thus far remain flawed and exhibit a latent security risk which appears not to have been appreciated. The present inventors have observed that when some callers (particularly the elderly) are entering sensitive information using a touch-tone keypad, they have a tendency to vocalise the digits as they press the associated key. Because voice signals are allowed to pass through a DTMF clamping system as well as the systems described in <CIT> and <CIT>, there remains a risk that the agent or third party will hear the sensitive information and it will be recorded by a call recorder.

A second security risk remains in state of the art systems owing to a deficiency in DTMF clamping and other DMTF blocking or masking systems. Such systems must first detect that a DTMF tone is present before they can remove it from the signal. Inevitably there is a delay between the beginning of the tone and the point at which it is removed due to the complexity of the recognition routines. Accordingly, even where systems are provided for removing DTMF from a signal, a detectable amount is likely to pass through.

In view of the above there remains a need to provide an improved system and method for secure transmission of data signals.

The invention is defined by the subject-matter of the appended claims.

Accordingly, in a first aspect, the present invention provides a telephone call processing system for processing telephone calls comprising voice signals and data signals between a caller and an agent, the system comprising:.

By operating in a second mode in which both voice and data signals passing from the first interface to the second interface are attenuated to impede the agent from receiving both voice and data signals from the caller, it is impossible for sensitive information to be stolen by the agent or from the agent's computer or the call centre network. By 'impeded' it is meant that the signals are attenuated to such an extent that the agent cannot discern the entirety of the information content of the signals (both voice and data). Even if the caller chose to read out the digits whilst entering them using DTMF, the agent would be prevented from receiving the sensitive information.

Preferably, the processor is adapted to cause the telephone call processing system:.

Thus, a caller and an agent are able to converse as the caller begins to enter the sensitive information, and as the caller approaches the end of the entry, but for a period during the middle of the entry, the system operates in the second mode such that the agent is impeded from receiving voice and data signals from the caller.

Preferably, the processor is configured to switch from the first mode to the second mode upon detection, by the detection means, of a first pre-determined number of discrete data signals of the string of discrete data signals. Thus, the system may be configured to ensure a certain period for operating in the first mode and to ensure switching to the second mode at an appropriate time. Moreover, the switch to the second mode may take place at a particular point to ensure a certain subset of the string of discrete data signals is not received by the agent. For instance, if digits <NUM> to <NUM> are more sensitive than digits <NUM> to <NUM>, the system make be configured to switch from the first mode to the second mode on or before receipt of the first six digits.

Moreover, the processor may be configured to revert from the second mode to the first mode upon detection, by the detection means, of a second pre-determined number of discrete data signals of the string of discrete data signals. Thus, the system may be configured to ensure a certain period for operating in the second mode and to ensure switching back to the first mode at an appropriate time. Moreover, the switch back to the first mode may take place at a particular point to ensure a certain subset of the string of discrete data signals is not received by the agent. For instance, if digits <NUM> onwards are less sensitive than digits <NUM> to <NUM>, the system make be configured to switch from the second mode back to the first mode on or after receipt of the first twelve digits.

In certain embodiments, information represented by a subset of the string of discrete data signals may be indicative of its length, in which case the processor may be configured to determine that length once the subset has been detected and decoded by the detection means. It is particularly helpful to know the length of the string of data signals to determine an appropriate number of data signals to receive whilst operating in each of the first and second modes. For instance, to ensure adequate security, it may be appropriate to operate in the second mode for <NUM>% of the data signals in the string of data signals. In that case, it would be necessary for the system to determine the length of the string. Preferably the subset is at the beginning of the string.

Preferably, the processor is configured to revert from the second mode to the first mode upon detection, by the detection means, of a number of discrete data signals of the string of discrete data signals equal to the determined length minus a third pre-determined number. It may be appropriate to operate in the first mode during receipt of a certain number of discrete data signals at the end of the string. For instance, it may be appropriate to operate in the first mode during receipt of the final four discrete data signals of the string. Thus, the system make be configured to switch from the second mode back to the first mode after receipt of <NUM> fewer than the total number of digits.

The attenuation means may be configured to selectively block voice and data signals passing from the first interface to the second interface to prevent the agent from receiving voice and data signals from the caller. Blocking the signals rather than merely attenuating them removes all risk of the information content of the signals being received by the agent or a third party.

Optionally, the attenuation means is further configured to attenuate voice and data signals passing from the second interface to the first interface to impede the caller from receiving voice and data signals from the agent, in which case, in the second mode, the processor may cause the attenuation means to attenuate voice and data signals passing from the second interface to the first interface. This may be helpful to remind caller and agent that the caller cannot have a two-way conversation with the agent. Rather than allow one-way communication from the agent to the caller, the system may be configured to prevent all communication between caller and agent.

Again, the attenuation means may be configured to selectively block voice and data signals passing from the second interface to the first interface to prevent the caller from receiving voice and data signals from the agent. As mentioned above, blocking the signals rather than merely attenuating them removes all risk of the information content of the signals being received by the caller from the agent.

Optionally, the processor may be configured to cause the detection means to begin detecting and decoding the string of discrete data signals, either:.

Until the user begins to enter the string of data signals, the detection means need not begin detecting and decoding. However, this must start as soon as the user begins to enter the string so as to avoid losing any data. In other words, the detection means must begin detecting and decoding when (or before) the user begins to enter the string of data signals. This could be achieved automatically by the system identifying the first data signal in the string and automatically commencing detection and decoding at that time. That would be most convenient. However, since data signals are often used for non-sensitive communication, it is difficult for the system to discern whether a sensitive string is being entered or not. Accordingly, the agent may send the system an instruction to begin detecting and decoding when (or before) prompting the user to enter the sensitive information.

Preferably, the string of discrete data signals is a plurality of dual-tone multi-frequency (DTMF) audio tones and the detection means is configured to determine an alphanumeric digit associated with each DTMF audio tone.

Preferably the alphanumeric digits associated with the plurality of DTMF audio tones of the string of discrete data signals represent a whole or part of a Primary Account Number (PAN) or card security code (e.g. CV2) of a bank card.

In certain embodiments, the processor may be configured to communicate the information from the detected and decoded string of discrete data signals to a third party for subsequent processing. For instance, the third party may be a payment processing company.

In a second aspect, the present invention provides a method of processing telephone calls comprising voice signals and data signals between a caller and an agent, the method comprising:.

Preferably, the step of operating the call processor comprises:.

Preferably, the step of switching the call processor from the first mode to the second mode is triggered upon detection of a first pre-determined number of discrete data signals of the string of discrete data signals.

Moreover, the step of reverting the call processor from the second mode to the first mode may be triggered upon detection of a second pre-determined number of discrete data signals of the string of discrete data signals.

In certain embodiments, the step of detecting and decoding the string of data signals comprises detecting and decoding a subset of the string, in which case the method may further comprise determining the length of the string based upon information represented by the subset.

Preferably, the step of reverting the call processor from the second mode to the first mode is triggered upon detection of a number of discrete data signals of the string equal to the determined length of the string minus a third pre-determined number.

The step of attenuating the voice signals and data signals received from the caller may comprise blocking said voice and data signals to prevent the agent from receiving them.

Optionally, the step of operating the call processor in the second mode further comprises attenuating voice signals and data signals received from the agent to impede the caller from receiving them.

Again, the step of attenuating the voice signals and data signals received from the agent may comprise blocking said voice and data signals to prevent the caller from receiving them.

Optionally, the step of detecting and decoding the string of data signals received from the caller is triggered either:.

Preferably, the string of discrete data signals is a plurality of DTMF (dual-tone multi-frequency) audio tones, in which case the method further comprises determining an alphanumeric digit associated with each DTMF audio tone.

Preferably, the alphanumeric digits associated with the plurality of DTMF audio tones of the string of discrete data signals represent a whole or part of a Primary Account Number (PAN) or card security code (e.g. CV2) of a bank card.

In certain embodiments, the method further comprises the step of communicating the information from the detected and decoded string of discrete data signals to a third party for subsequent processing.

Preferred embodiments of the invention will now be described in detail with reference to the accompanying drawings, in which:.

<FIG> shows a telephone call processing system <NUM> according to a first embodiment of the present invention.

The system comprises a first telephone interface <NUM> configured to receive telephone signals from a caller <NUM> across a public switched telephone network (PSTN) <NUM>. The first telephone interface <NUM> is further configured to send telephone signals to the caller <NUM> across the PSTN <NUM>.

The system comprises a second telephone interface <NUM> configured to send telephone signals to an agent <NUM>. The agent <NUM> is one of a plurality of agents operating in a call centre <NUM>. The second telephone interface may be configured to communicate with the agent <NUM> across a direct line, or via a private branch exchange (PBX). The second telephone interface <NUM> is configured to send telephone signals to the agent <NUM> across the PSTN <NUM> such that it is remote from the call centre <NUM> and can therefore be managed by a third party, for example. However, this need not be the case, and the second telephone interface <NUM> could instead be part of a private network (not shown) within the call centre and configured to send telephone signals to the agent <NUM> across the private network. The second telephone interface <NUM> is further configured to receive telephone signals from the agent <NUM> across the same communication channels mentioned above.

The first and second telephone interfaces are configured to pass telephone signals therebetween. In other words, telephone signals from the caller <NUM> received at the first telephone interface <NUM> may be passed to the second telephone interface <NUM> and thence to the agent <NUM>. Likewise, telephone signals from the agent <NUM> received at the second telephone interface <NUM> may be passed to the first telephone interface <NUM> and thence to the caller <NUM>.

The system further comprises a data interface <NUM> configured to send data signals to a third party <NUM> across a data network <NUM> and if necessary to receive data signals from the third party <NUM> across the network <NUM>. The third party may be a payment processing service; a bank; a building society; a retailer or suchlike.

The system further comprises a means <NUM> for attenuating the telephone signals passed between the first and second telephone interfaces <NUM>, <NUM> (e.g. from the first telephone interface <NUM> to the second telephone interface <NUM>, and optionally from the second telephone interface <NUM> to the first telephone interface <NUM>). The means may be implemented in software or hardware in any one of a number of conventional ways with which a skilled person would be familiar. The purpose of the means <NUM> for attenuating is to impede the agent (and/or caller) from receiving telephone signals from the caller (or agent, respectively). In this connection, by 'telephone signals' it is meant all signals (both voice signals and data signals, of both in-band frequencies and out-of-band frequencies). Preferably, the means <NUM> for attenuating completely blocks said signals, such that the agent and/or caller is completely prevented from receiving them. Alternatively, the signals are so attenuated that the agent and/or caller cannot practically detect them even if traces of them exist. Alternatively, the signals are so modified (for instance by superposition) that their information content does not reach its destination.

The system further comprises a means <NUM> for detecting and decoding data signals received at the first interface. In the embodiments described herein, the data signals take the form of a plurality of discrete DTMF tones that may be generated by a touch-tone keypad, for example. A plurality of consecutive tones forms a string, an example of which may be a whole or part of a primary account number of a credit or debit card. Means for detecting and decoding DTMF tones are well established and a skilled person would be capable of implementing such means in software or hardware.

In order to operate the system, a processor <NUM> and memory <NUM> are provided, each suitably configured to enable the system to carry out the functions described herein, as would be appreciated by a skilled person.

Operation of the system will now be described with reference to <FIG>.

The present invention finds particular utility in situations in which a caller discusses a purchase with an agent prior to entering his or her credit or debit card details. Callers enjoy personable human interaction when making a purchase; this provides an opportunity to ask questions about the product or service being purchased and callers are left reassured that the entity from which they are making a purchase is bona fide. For these reasons at least, purchases from a human agent are still preferred over fully automated purchasing systems.

Whilst the caller and agent are discussing the purchase, two-way communication is required. That is, all telephone signals received from the caller <NUM> at the first telephone interface <NUM> must be passed to the second telephone interface <NUM> and thence to the agent <NUM>, and all telephone signals received from the agent <NUM> at the second telephone interface <NUM> must be passed to the first telephone interface <NUM> and thence to the caller <NUM>. It goes without saying that two-way communication of voice signals is necessary; but it is also particularly advantageous for data signals generated by the caller to be able to pass from the first telephone interface <NUM> to the second telephone interface <NUM> to enable a caller to interact with an IVR in the call centre (not shown), for instance. Transmission of data signals generated by the agent <NUM> may optionally be passed from the second telephone interface <NUM> to the first telephone interface <NUM>, if desired.

During a call between a caller and an agent to make a purchase, there will come a time when the caller is prompted (for example, by the agent) to begin entering their credit or debit card details using their touch-tone keypad. This they will do. Occasionally, whilst entering their credit or debit card details, callers will encounter difficulties, make a mistake, or generally require guidance or encouragement from the agent. For this reason, it is desirable for two-way communication between the caller and the agent to be maintained.

However, if two-way communication is maintained throughout the period the caller is entering their credit or debit card details, the agent (and any recording equipment utilised by the call centre) will receive the encoded card details, exposing the caller to a risk of theft of their card details.

Accordingly, and referring to <FIG>, a preferred embodiment of a system and method according to the present invention operates as follows.

During (optionally throughout) the period of time in which the caller <NUM> is entering their credit or debit card details, the system <NUM> operates exclusively in each of a first mode and a second mode. By 'exclusively' it is meant that the system <NUM> does not operate in any mode other than the first mode or the second mode, and also does not operate in those modes simultaneously.

In the first mode (illustrated in <FIG>), voice and data signals 400a sent by the caller to the first telephone interface <NUM> are passed to the second telephone interface <NUM> and thence to the agent <NUM>. In the illustrated embodiment, voice and data signals 400b sent by the agent to the second telephone interface <NUM> are passed to the first telephone interface <NUM> and thence to the caller <NUM>. This is desirable to maintain two-way communication. In other words, whilst the system is operating in the first mode, the caller and the agent may continue to communicate as usual so that the agent can provide the caller with guidance.

The data signals (e.g. DTMF tones) received at the first telephone interface <NUM> whilst the system is operating in the first mode are detected and decoded by the means for detecting and decoding <NUM>, and the decoded information is temporarily stored in memory <NUM>.

At some point, the system switches to operate in the second mode. Switching from the first mode to the second mode will be explained in more detail below.

In the second mode (illustrated in <FIG>), voice and data signals 400c sent by the caller to the first telephone interface <NUM> are attenuated by the means for attenuating <NUM>, resulting in attenuated voice and data signals 400c' being passed to the second telephone interface <NUM> and thence to the agent <NUM>. The voice and data signals 400c' are attenuated to such an extent that the agent cannot detect them. In alternative embodiments, the means for attenuating <NUM> blocks the signal from passing to the second telephone interface such that the agent <NUM> does not receive them.

In the illustrated embodiment, voice and data signals 400d sent by the agent to the second telephone interface <NUM> are passed to the first telephone interface <NUM> and thence to the caller <NUM>. This enables the agent to provide the caller with guidance even whilst the signals from the caller are not being passed to the agent. For instance, if the system has been operating in the second mode for a significant length of time, the agent may deduce a problem, and provide the caller with guidance.

As is the case in the first mode, the data signals (e.g. DTMF tones) received at the first telephone interface <NUM> whilst the system is operating in the second mode are detected and decoded by the means for detecting and decoding <NUM>, and the decoded information is temporarily stored in memory <NUM>.

<FIG> illustrates an alternative second mode. Here, voice and data signals 400e sent by the caller to the first telephone interface <NUM> are attenuated by the means for attenuating <NUM> as with the embodiment illustrated in <FIG>. However, unlike with that embodiment, voice and data signals 400f sent by the agent to the second telephone interface <NUM> are attenuated by the means for attenuating <NUM>, resulting in attenuated voice and data signals 400f' being passed to the first telephone interface <NUM> and thence to the caller <NUM>. Again, the voice and data signals 400f' are attenuated to such an extent that the caller cannot detect them. In alternative embodiments, the means for attenuating <NUM> blocks the signal from passing to the first telephone interface such that the caller <NUM> does not receive them.

As is the case in the first mode, the data signals (e.g. DTMF tones) received at the first telephone interface <NUM> whilst the system is operating in the alternative second mode are detected and decoded by the means for detecting and decoding <NUM>, and the decoded information is temporarily stored in memory <NUM>.

The decoded information temporarily stored in memory <NUM> is transmitted by the system <NUM> across a network <NUM> to a third party such as a payment processing system <NUM>. Transmission may be in real-time (that is, concurrently upon receipt of each data signal) or the information may be stored and then transmitted once all of it has been received.

The pattern of operating in the first mode and operating in the second mode during (optionally throughout) the period of time in which the caller <NUM> is entering their credit or debit card details may be altered to suit particular circumstances. For instance, the system may begin operating in the first mode and switch to operating in the second mode. Optionally, the system may revert to operating in the first mode. Any pattern is possible. In practice, the system may be configured to switch between the first and second modes as often as required to facilitate conversation between the caller and agent and to ensure adequate security of the caller's information. It will be appreciated that there is a balance to strike here. The longer the system operates in the first mode, the better the prospects for two-way conversation but the greater the risk of giving the agent access to secure information. The longer the system operates in the second mode, the better the security but the worse the prospects for two-way conversation.

<FIG> illustrates an exemplary operating sequence of a system according to the present invention. In particular, the diagram shows the flow of signals between caller <NUM>, system <NUM> and agent during (optionally throughout) the period of time in which the caller <NUM> is entering their credit or debit card details by generating DTMF tones using a touch-tone keypad.

The diagram shows that the system is configured to operate in the first mode, before switching to operate in the second mode, before reverting to operate in the first mode. In the illustrated embodiment, the system is configured to operate in the first mode (that is, to pass both voice and data signals from the first telephone interface to the second telephone interface and thence to the agent) until the means <NUM> for detecting and decoding the data signals has detected (and optionally decoded) six DTMF tones that represent, for example, the first six digits (i.e. digits <NUM> to <NUM>) of the caller's PAN.

Once the system has received six DTMF tones, it switches to operate in the second mode (that is, to attenuate (preferably block) voice and data signals passing from the first telephone interface to the second telephone interface to impede (preferably prevent) the agent from receiving them) until the means <NUM> for detecting and decoding the data signals has detected (and optionally decoded) a further six DTMF tones that represent, for example, the middle six digits (i.e. digits <NUM> to <NUM>) of the caller's PAN.

Once the system has received the further six DTMF tones (i.e. twelve DTMF tones in total), it reverts to operate in the first mode again until all remaining tones have been received.

Card details vary in their particulars depending on the issuing network. The PAN varies in two important respects. Firstly, the first few numbers varies depending on the issuer identification number (IIN). For example, the PANs on cards issued by American Express begin <NUM> or <NUM>, whereas the PANs on cards issued by Maestro begin with numbers between <NUM> and <NUM> and between <NUM> and <NUM>. Secondly, the length of the PAN varies depending on the issuer. For example, PANs on cards issued by Diners Club International have length <NUM>; whereas PANs on cards issued by MasterCard have length <NUM>; and PANs on cards issued by Switch have length <NUM>, <NUM> or <NUM>. The table below gives the IIN ranges and the PAN length for the most common issuing networks.

By knowing the relationships between IIN and PAN length (by storing this information in a look-up table in the system memory <NUM>, for example), it is possible to determine the number of DTMF tones that a caller will be expected to generate after the IIN has been detected and decoded. For instance, as soon as the means <NUM> for detecting and decoding has detected and decoded DTMF tones representing numerals <NUM>-<NUM>-<NUM>-<NUM>, for example, the system knows to expect the caller to generate a total of <NUM> DTMF tones.

This variability in the particulars of card details has implications for when the system switches from the first mode to the second mode; and for when the system reverts to the first mode. This depends on a number of constraints.

A first constraint pertains to the IIN. In order for a call centre to be certain it has received a full IIN, the system must be configured to operate in the first mode until at least six DTMF tones have been received (corresponding to the maximum length of an IIN across all issuing networks). However, for any given PAN, it is possible to discern which of the issuing networks in the table above is correct after based on just the first four digits (and also to discern between most based on just the first two digits). Accordingly, in certain embodiments the system could be configured to operate in the first mode until the first two or the first four DTMF tones have been received.

A second constraint pertains to the PAN length. In certain embodiments, it may be desirable to maintain two-way communication between the caller and the agent as the caller begins to enter the digits of the PAN and as the caller approaches the end of PAN entry, as this is when interaction between the caller and the agent is most helpful. Thus, a particularly preferred implementation is for the system to operate in the first mode until the first six DTMF tones have been received, and whilst the final four DTMF tones are being received. In such an embodiment, it will be appreciated that the system will operate in the second mode during entry of a different number of tones (depending on PAN length). For example, with a card of length <NUM>, the system will operate in the second mode during receipt of <NUM> tones (i.e. first mode for tones <NUM> to <NUM>; second mode for tones <NUM> and <NUM>; first mode for tones <NUM> to <NUM>). With a card of length <NUM>, the system will operate in the second mode during receipt of <NUM> tones (i.e. first mode for tones <NUM> to <NUM>; second mode for tones <NUM> to <NUM>; first mode for tones <NUM> to <NUM>). With a card of length <NUM>, the system will operate in the second mode during receipt of <NUM> tones (i.e. first mode for tones <NUM> to <NUM>; second mode for tones <NUM> to <NUM>; first mode for tones <NUM> to <NUM>).

In the above-described embodiment, the system must be configured so that the means <NUM> for detecting and decoding the data signals detects and decodes the IIN (e.g. the first six DTMF tones), and based upon the IIN determines the length of the PAN using a look-up table. Based upon the length of the PAN, the system may calculate for how many tones it must operate in the second mode before reverting to the first mode in time for the system to operate in the first mode for <NUM> tones.

However, in the above-described embodiment, it will be appreciated that the level of security (as measured by the number of DTMF tones throughout receipt of which the telephone signals are attenuated or blocked) will be different for cards of different PAN lengths. Instead, it may be preferred to attenuate or block the telephone signals during receipt of a fixed number of DTMF tones. A preferred level of security is achieved when telephone signals are attenuated or blocked during receipt of six DTMF tones. Thus, a particularly preferred implementation is for the system to operate in the first mode until the first six DTMF tones have been received (for reasons given previously), and to operate in the second mode until the next six DTMF have been received. In such an embodiment, it will be appreciated that the system will revert to operating the first mode for different number of tones (depending on PAN length). For example, with a card of length <NUM>, the system will not revert to operating in the first mode (i.e. first mode for tones <NUM> to <NUM>; second mode for tones <NUM> to <NUM>). With a card of length <NUM>, the system will revert to operating in the first mode for receipt of <NUM> tones (i.e. first mode for tones <NUM> to <NUM>; second mode for tones <NUM> to <NUM>; first mode for tones <NUM> to <NUM>). With a card of length <NUM>, the system will revert to operate in the first for receipt of <NUM> tones (i.e. first mode for tones <NUM> to <NUM>; second mode for tones <NUM> to <NUM>; first mode for tones <NUM> to <NUM>).

Alternatively the system may switch between modes based on time. For instance, the system could be configured to operate in the first mode for a first predetermined period of time before switching to operate in the second mode for a second predetermined period of time. Optionally, the system may immediately thereafter revert to operating in the first mode for a third predetermined period of time. The predetermined periods of time may be set according to the average time taken for a caller to enter a certain number of digits.

It will be appreciated that the embodiments described above are mere examples of implementations. In particular, the values given in respect of the number of tones are merely exemplary, and may be any suitable predetermined number of tones. The ways in which the number of are determined may vary depending on the preferred implementation.

<FIG> illustrates one embodiment of a method of processing telephone calls commensurate with the system described in connection with <FIG>. In step <NUM>, the system receives voice and data signals from a caller. The voice and data signals are received at a first telephone interface. In step <NUM>, DTMF tones in the data signals are detected and decoded. The tones may be decoded in real time as they are received or stored temporarily in a memory and decoded in a batch. In any case, in step <NUM> a determination is made as to whether six DTMF tones have been detected. If not, the process returns to step <NUM>. If so, the process moves on to step <NUM>.

Optionally, the method may include the step of determining the length of the PAN based on the decoded digits corresponding to the IIN. Once the tones representing the IIN have been detected and decoded, they may be compared to a look-up table to find the corresponding length of the PAN.

Until this point, the voice and data signals received from the caller have been passed to the agent. In step <NUM>, the system begins to attenuate (preferably block) the voice and data signals received from the caller such that the agent is impeded (preferably prevented) from receiving them. Nevertheless, the DTMF tones in the data signals continue to be detected and decoded. In step <NUM> a determination is made as to whether a further six DTMF tones have been detected. If not, the process returns to step <NUM>. If so, the process moves on to step <NUM>.

At this point, the system ceases to attenuate (block) the voice and data signals received from the caller such that the agent can again receive them. The DTMF tones in the data signals continue to be detected and decoded. In step <NUM> a determination is made as to whether all remaining DTMF tones have been detected. If not, the process returns to step <NUM>. If so, the process ends.

Claim 1:
A telephone call processing system for processing telephone calls comprising voice signals and data signals between a caller and an agent, the system comprising:
a first interface for receiving voice signals and data signals from the caller and a second interface for receiving voice signals and data signals from the agent, the first and second interfaces configured to selectively pass voice signals and data signals therebetween to enable communication between the caller and agent;
attenuation means configured to selectively attenuate voice and data signals passing from the first interface to the second interface to impede the agent from receiving voice and data signals from the caller;
detection means configured to detect and decode data signals received at the first interface; and
a processor coupled to the attenuation means and detection means and configured to cause the detection means to begin detecting and decoding a string of discrete data signals from the caller, the string of discrete data signals having a length and conveying sensitive information;
wherein whilst said string of discrete data signals is being received at the first interface, the telephone call processing system is configured to operate exclusively in each of:
a first mode in which voice signals and data signals are permitted to pass from the first interface to the second interface to enable the agent to receive voice and data signals from the caller; and
a second mode in which the processor causes the attenuation means to attenuate voice and data signals passing from the first interface to the second interface to impede the agent from receiving voice and data signals from the caller;
wherein information represented by a subset of the string of discrete data signals is indicative of its length, and wherein the processor is configured to determine that length once the subset has been detected and decoded by the detection means.