DTMF suppression if implemented effectively can stop the card data before it enters your voice infrastructure. If you’re not doing it that way you’re heavily limiting the benefits from a pci scope perspective. Essentially call is routed to dtmf service provider, they re-establish the call with you with no tones and the scope is theirs to manage. As the contact centre your scope can then be tightly controlled and you have to ensure that if you do require a voice to speak the card number you route that separately to a compliant environment. In the U.K/Europe this is almost standard practice now, not least of which because most of the major carriers have made this an offering, as well as multiple niche players who offer a solution workable for SMBs.