Card details should never be read aloud
Plenty of small businesses still take card numbers over the phone, written on a pad and typed into a terminal afterwards. It is an ordinary practice with an unpleasant amount of risk attached, and the risk grows the moment calls start being recorded — which is to say, the moment most businesses modernise anything.
What happens to a spoken card number
It exists in more places than the person reading it out realises: the recording, the transcript, the note somebody made, and the memory of anyone in the room. Each of those is a copy you are now responsible for, and a recording containing card numbers is a materially more serious thing to hold than a recording of a conversation about haircuts. Deleting it later does not undo the period in which it existed.
The better arrangement
On a payment page, on their own phone, while still on the call. Nothing sensitive is spoken.
Because it was never said. This is the whole point, and it also makes the recording safe to keep.
Which is their job and their regulatory burden rather than yours.
Which is all you actually needed.
Why "we delete the recording afterwards" is not an answer
It relies on somebody remembering, on the deletion being complete, and on nothing having been copied in the meantime. Any control that depends on a busy person doing something reliably is not a control. Not capturing the data in the first place is the only version of this that holds up, and it is also much less work.
If you still take card numbers by phone
Two things are worth doing this week. Stop writing them on paper that sits at a desk — that pad is the part most likely to cause you an actual problem. And if you record calls at all, understand that you are currently storing card numbers in your recordings, which is very likely more than you intended and more than your customers assume.
Frequently asked
It does not need to, and should not. The caller enters their details on a payment page while still on the call, so nothing sensitive is spoken, recorded or transcribed.
It ends up in the recording, the transcript and whatever was written down — several copies you then have to protect, and deleting them later does not undo the period they existed.
That depends on somebody remembering, the deletion being complete, and nothing having been copied. A control that relies on a busy person is not a control.
The payment processor, which is their regulatory burden rather than yours.