Tell customers not to send card numbers, delete any that arrive from every folder and from stored form entries, and give them a safe way to pay, such as a hosted payment link or a phone call.

Card numbers in the inbox

A customer wants to hold a booking or pay a deposit, so they type the whole card number, the expiry date and the three digits from the back into your contact form. Or they reply to your email with it.

It lands in a shared inbox. Someone forwards it to whoever handles payments, the mailbox syncs it to three phones, and the nightly backup copies it.

Long after the payment is made, the number is still there, in more places than anyone could list from memory.

October is Cyber Security Awareness Month, and this is a security problem many small businesses have without ever thinking of it as one.

Why customers do it

Customers are not being careless. Usually the business asked for payment and offered no safe way to give it.

A line on a reservation form saying a credit card is required, placed above a message box, is an invitation.

So is an invoice that says please send payment details, with only an email address to send them to.

Some older websites go further, with card fields on an ordinary contact form that sends the details as a plain email. That is not a customer's mistake; the site is asking for it.

Where one number ends up

The fourth surprises most owners. A form plugin that keeps a copy of each message turns the website into a store of card numbers, on a server that automated scripts probe for weaknesses every day.

What the card rules say

The card industry's security standard, PCI DSS, says card numbers must never be sent unprotected by email, text or instant message, and that the security code on the back must not be kept once a payment is authorised.

Your agreement with your payment processor will normally require you to follow that standard.

You cannot stop a customer sending a number. Keeping it, forwarding it or replying with it quoted is up to you.

Ask your processor how they want an emailed number handled. Most will tell you to take payment another way and delete the message.

Tell customers before they type

The cheapest fix is a sentence in the right place. Under every message box: please do not include card details here; we will send you a secure payment link.

Put the same idea on booking confirmations, quotes and invoices: we never ask for card numbers by email. It tells honest customers what to do, and it makes a fraudster's request for card details look out of place.

If the website says a card is required, the same sentence should say how the card will be taken.

A worked example

An equipment rental company working from a fenced yard beside the highway rents compactors, lifts, mini excavators and carpet cleaners to contractors and homeowners. Most reservations arrive through a form on its website.

The form said a credit card was required to reserve equipment, just above a box for comments. Customers did the obvious thing and typed their card details into the box.

The form plugin had saved every submission in the website's database, three years of them. The emails went to the counter computer and two phones, and some were printed for whoever took payments.

The fix began with the wording: reservations are held with a card taken by phone or through a secure link we email you, so please do not type card details here. The company set up payment links with its processor.

Then it deleted the stored form entries and turned storage off, cleared card details from every mail folder and shredded the printouts. Counter staff now key a card given by phone straight into the terminal.

Offer a safe way to pay

The customer who emails a card number usually just wants to pay. Give them a route that keeps the number out of your hands.

On a hosted payment page the customer types the card on your processor's page, so the number never reaches your website or your inbox.

Many processors and accounting packages can email a payment link, or an invoice with a pay button, for exactly this situation.

For customers who would rather talk, a card keyed straight into the terminal during a phone call works, as does an Interac e-Transfer. Which suits you depends on how you sell, and it is worth setting up properly once.

When one arrives anyway

Some customers will send a number whatever the form says, so staff need a routine they can follow without asking.

Do not forward the message or copy the number anywhere, including a note to process later. Reply with the number deleted from the quoted text, and send the payment link or offer to call.

Then delete the original, and empty the deleted items folder, where it otherwise sits indefinitely.

If any computer in the office still downloads mail rather than syncing it, check that one too. It keeps its own copy, which deleting on the server does not touch.

The counter-case

A business that takes payment only in person, at a counter or on the job, will rarely see an emailed card number. It needs the habit of deleting, not a new payment system.

A shop with a proper online checkout already has the safe route. Its work is the wording on its contact form and invoices, and a search of the inbox once a year.

Everyone else should treat this month as the time to look, because numbers that have already arrived do not leave on their own.

Before another card arrives

  1. Search the inbox for card details.
  2. Delete them from every folder, including deleted items.
  3. Check the website's stored form entries.
  4. Add a line under every message box.
  5. Set up a payment link with your processor.
  6. Remove card fields from any plain form.
  7. Tell staff what to do when one arrives.

Step three is the easiest to miss. The inbox is in front of you every day; a database of old form submissions is not, and it can hold years of card numbers on a public server.

How the card standard applies to a business taking payments online is covered in PCI DSS 3.2 and the small online shop.

Frequently asked questions

Why do customers send card numbers by email?

Usually because the business asked for payment or a deposit and offered no safe way to give it. A line saying a card is required, above a message box, invites it.

Where does an emailed card number end up?

In the shared inbox, every synced phone, quoted replies and forwards, backups and printouts, and often in the website database if the form plugin saves submissions.

What does the card industry standard say?

PCI DSS says card numbers must never be sent unprotected by email or messaging, and the security code must not be kept once a payment is authorised.

What should staff do when one arrives?

Not forward it or copy it anywhere. Reply with the number removed from the quoted text, send a payment link or offer to call, then delete the original from every folder.

What is a safe way to take payment remotely?

A hosted payment page or payment link from your processor, a card keyed straight into the terminal during a call, or an Interac e-Transfer. The card never sits in your inbox.

Do website forms really store messages?

Many form plugins keep a copy of every submission in the website database. Check the settings, delete stored entries containing card details and turn storage off or limit it.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Card numbers sitting in your inbox?

Tell us how customers pay you today. We will suggest a safe payment route and wording that stops cards arriving by email.

Start a Conversation