PCI-Sensitive Payment Simulation

Browser lacks capabilities required to play.

Upgrade or switch to another browser.

Loading…

<<set $score to 0>> <<set $criticalFail to false>> <div class="scenario-heading">Scenario Simulation: Failed Payment and Card Update Request</div> You are supporting Daniel Reed, a FinTech customer whose payment failed. His subscription may be suspended in 48 hours. Your goal is to resolve the issue while avoiding PCI-sensitive mistakes. <div class="scenario-note">Passing grade: 80%. You must reach at least 80% to pass the simulation.</div> [[Begin Simulation|Step 1]]

<div class="scenario-step-title">Step 1: Opening and Verification</div> <div class="scenario-step-grid"> <div class="scenario-step-copy"> <div class="scenario-customer-label">Customer says:</div> <p class="scenario-customer-quote">"My card keeps getting declined and I don’t have time for this. Can you just update it for me now?"</p> <p>What should you do next?</p> </div> <div class="scenario-inline-figure"><img src="cx-calling.png" alt="Customer calling with a failed payment issue" /></div> </div> [[A. Ask for the full card number.|Feedback 1 Fail][$criticalFail to true]] [[B. Verify using approved identity steps, then guide them to the secure payment update method.|Feedback 1 Correct][$score += 15]] [[C. Ask the customer to email a screenshot of the card error.|Feedback 1 Fail]]

<span class="scenario-feedback-label">Correct.</span> You acknowledged the issue, avoided asking for card data, and used approved verification steps. [[Continue|Step 2]]

<span class="scenario-feedback-label">Incorrect.</span> The agent must not ask for, collect, or receive full card details. Verification should use approved non-card identifiers. [[Retry|Step 1]] [[Continue|Step 2]]

<div class="scenario-step-title">Step 2: Customer Attempts to Share Card Details</div> <div class="scenario-step-grid reverse"> <div class="scenario-step-copy"> <div class="scenario-customer-label">Customer says:</div> <p class="scenario-customer-quote">"Fine, the card number is 4539..."</p> <p>What should you do?</p> </div> <div class="scenario-inline-figure contain-image"><img src="cx-calling-step-2.png" alt="Customer attempting to share card details during a call" /></div> </div> [[A. Let the customer finish, then avoid repeating it.|Feedback 2 Fail][$criticalFail to true]] [[B. Politely stop the customer and redirect to the secure payment workflow.|Feedback 2 Correct][$score += 25]] [[C. Write the number down temporarily and delete it later.|Feedback 2 Fail][$criticalFail to true]]

<span class="scenario-feedback-label">Correct.</span> You stopped the disclosure before more sensitive data was shared. Best-practice language: "For your security, please don’t share your full card number with me. I’ll guide you through the secure payment process." [[Continue|Step 3]]

<span class="scenario-feedback-label">Incorrect.</span> This is a critical PCI failure. The agent must interrupt politely and prevent further card disclosure. [[Retry|Step 2]] [[Continue|Step 3]]

<div class="scenario-step-title">Step 3: Secure Payment Workflow</div> <div class="scenario-step-grid"> <div class="scenario-step-copy"> <div class="scenario-customer-label">Customer says:</div> <p class="scenario-customer-quote">"So how am I supposed to update it if you won’t take the card?"</p> <p>Which action is most appropriate?</p> </div> <div class="scenario-inline-figure contain-image"><img src="cx-calling-step-3.png" alt="Customer frustrated during a payment update support call" /></div> </div> [[A. Send the approved secure payment link or transfer to secure IVR.|Feedback 3 Correct][$score += 25]] [[B. Ask for only the first and last four digits.|Feedback 3 Fail]] [[C. Ask the customer to try again later and end the call.|Feedback 3 Fail]]

<span class="scenario-feedback-label">Correct.</span> The customer should enter card details directly into the secure system, not share them with the agent. [[Continue|Step 4]]

<span class="scenario-feedback-label">Incorrect.</span> The agent should use the approved secure payment channel, such as secure IVR or secure payment link. [[Retry|Step 3]] [[Continue|Step 4]]

<div class="scenario-step-title">Step 4: Recording and Notes</div> <div class="scenario-step-grid"> <div class="scenario-step-copy"> <div class="scenario-customer-label">Customer says:</div> <p class="scenario-customer-quote">"Will this call record my card information?"</p> <p>What should you document in the CRM?</p> </div> <div class="scenario-inline-figure contain-image"><img src="cx-calling-step-4.png" alt="Customer asking whether payment information is being recorded during the call" /></div> </div> [[A. Customer updated card ending in 1234 after issuer decline.|Feedback 4 Fail]] [[B. Full card number and expiration date for troubleshooting.|Feedback 4 Fail][$criticalFail to true]] [[C. Customer attempted payment update via secure workflow. Payment retry pending/confirmed according to system status.|Feedback 4 Correct][$score += 15]]

<span class="scenario-feedback-label">Correct.</span> CRM notes should describe the action and outcome without storing sensitive payment data. [[Continue|Step 5]]

<span class="scenario-feedback-label">Incorrect.</span> Do not document card details. Use approved non-sensitive language only. [[Retry|Step 4]] [[Continue|Step 5]]

<div class="scenario-step-title">Step 5: Payment Still Fails</div> <div class="scenario-step-grid"> <div class="scenario-step-copy"> <p><strong>System status:</strong></p> <p>Payment update attempt failed again.</p> <div class="scenario-customer-label">Customer says:</div> <p class="scenario-customer-quote">"This is ridiculous. Just override it or escalate me now."</p> <p>What should you do next?</p> </div> <div class="scenario-inline-figure contain-image"><img src="cx-calling-step-5.png" alt="Customer frustrated after another failed payment update attempt" /></div> </div> [[A. Escalate immediately without troubleshooting.|Feedback 5 Fail]] [[B. Follow the failed-payment troubleshooting path and escalate only if criteria are met.|Feedback 5 Correct][$score += 20]] [[C. Ask for the CVV to confirm whether they entered it correctly.|Feedback 5 Fail][$criticalFail to true]]

<span class="scenario-feedback-label">Correct.</span> You followed the approved troubleshooting path and avoided asking for CVV or other sensitive authentication data. [[View Results|Results]]

<span class="scenario-feedback-label">Incorrect.</span> Agents should follow the approved payment troubleshooting process and must never ask for CVV. [[Retry|Step 5]] [[View Results|Results]]

<div class="scenario-step-title">Results</div> <div class="scenario-feedback-label">Your score: $score%</div> <<if $criticalFail is true>> <div class="scenario-feedback-label">Result: Automatic Fail</div> You triggered a critical compliance failure. Critical failures include asking for full card number or CVV, allowing card disclosure, writing card details, or bypassing the secure workflow. <<elseif $score >= 90>> <div class="scenario-feedback-label">Result: Pass</div> You met the passing standard. You recognized PCI-sensitive moments, redirected the customer safely, and used the approved secure workflow. <<else>> <div class="scenario-feedback-label">Result: Not Yet Passing</div> Passing score is 90%. Review the feedback and try again. <</if>> [[Go to Debrief|Debrief]] [[Restart Scenario|Start]]

# Debrief Questions 1. At what point did the interaction become PCI-sensitive? 2. What language helped stop the customer without damaging trust? 3. What information should never be documented? 4. What should the agent do if the customer insists on sharing card details? 5. How does this scenario protect both the customer and the business? [[Restart Scenario|Start]]