November 2025 Summaries

Merchants seeking to accept credit cards by phone without expanding their PCI-DSS compliance scope face risks from human operators, written notes, computer entry, and call recordings that may capture sensitive payment data. Phone payments are card-not-present transactions, but the involvement of staff can bring otherwise out-of-scope systems into PCI scope if they see, record, or store cardholder information. A recommended approach is to route customers through an interactive voice response system that collects card numbers and CVVs directly by keypad while operators are excluded from the sensitive portion of the call. The system can then encrypt and tokenize the information and send it to a payment service provider, while DTMF masking prevents keypad tones from being overheard or retained in recordings. Combining IVR-based collection, tone masking, and third-party tokenization can help vendors support phone payments while reducing exposure to protected payment data and associated compliance obligations.

Merchants of Record are legally and financially responsible for processing payments on behalf of other businesses, including handling refunds, chargebacks, taxes, compliance, and cross-border regulations. Because they often use multiple payment service providers to support various markets, currencies, and payment methods, they can face fragmented customer and transaction data, incompatible vaults, complex reconciliation processes, and slow integrations that hinder routing, payment recovery, compliance, and expansion. The passage argues that a neutral third-party payment vault can centralize tokenized payment data independently of individual processors, enabling a single integration across providers, dynamic routing, easier provider changes, unified real-time visibility, automated retries, and more consistent security and PCI DSS controls. It presents Basis Theory’s vault as a solution intended to give Merchants of Record greater operational control, portability, flexibility, and scalability across their payment ecosystems.

Subscription payments have grown rapidly across the UK and EU, driven by widespread consumer adoption, expanding card and online commerce, and forecasts of continued European subscription growth despite a modest slowdown in pace. Merchants operating across the region face differing regulatory regimes, including PSD2, SEPA, GDPR, and UK-specific FCA requirements, as well as varied consumer payment preferences and multiple local currencies outside the eurozone. Because a uniform approach may create friction, higher costs, or compliance risks, many European businesses use multiple payment service providers to localize transactions, support preferred payment methods, manage currency conversion, and optimize processing fees. A programmable payment vault using tokenization can support this multi-processor strategy by securely storing sensitive customer data, reducing PCI-DSS compliance burdens, preserving merchants’ control over payment credentials, and enabling them to change or add providers without disrupting recurring billing.

AI agents are increasingly being used for sales, customer onboarding, billing, debt collection, and commerce, with voice interfaces such as phone systems, IVRs, and drive-through bots expected to handle more payment-related interactions. The piece argues that collecting payment data through these channels introduces significant security, privacy, and PCI compliance challenges, particularly when card details may pass through language models, call logs, or orchestration systems. It describes common approaches such as Twilio Pay, direct processor integrations, and internally managed payment vaults, while noting their limitations around processor choice, operational complexity, and compliance scope. It presents tokenization as a way to keep raw card data out of AI systems by allowing agents to use restricted tokens and limited metadata instead, and promotes Basis Theory as infrastructure for this model across voice platforms and payment processors. A Twilio IVR example illustrates routing payment information to a vaulting service, replacing card details with a token before the remaining transaction data reaches an application.

October’s updates introduced Elements whitelabeling, more precise 8-digit BIN lookups for Web Elements and React, configurable card expiration-date validation for Web Elements, and Android SDK support for saving Token Intents. Vault API infrastructure was adjusted to enable more aggressive yet smoother scaling, while security vulnerabilities in Reactors and Proxy transforms and issues with concurrent Account Updater requests were addressed. Documentation was also revised to fix broken links, clarify descriptions, and simplify pages, and the Apple Pay and Google Pay connection endpoints were scheduled for deprecation on December 1.

Closed-loop payment systems allow a single merchant or organization to manage customer funds and transactions within its own ecosystem, unlike open-loop networks such as credit cards that involve banks, processors, gateways, and associated fees. By encouraging customers to preload balances, buy credits, or use gift cards, merchants can consolidate numerous small purchases into fewer larger transactions, reducing fixed processing costs, lowering decline and chargeback exposure, and generating working capital through prepayments. Coffee shops and online gaming companies illustrate how stored-value models can improve revenue on low-cost, high-frequency purchases, while similar approaches can support store credit and gifting. Establishing such a system requires customer trust, reliable mechanisms for collecting and tracking stored value, and secure payment infrastructure, with promotions and delivery options helping drive adoption.