Would you send your credit card details by e-mail?

I've just been gobsmacked by a conversation I had with my company's travel agent. I'm not going to name the travel agent as they are a global company.

I travel a lot for my job and my admin books my flights through our travel agent. They hold my credit card details in my profile and they charge all my flights directly to my credit card. They then send me an invoice and I use that as a receipt for my expenses to claim the cost of the flight back from my company.

Although that might seem strange, it works well for me as I get loads of BA miles on my BA/AmEx card.

Anyway, i've got a new credit card now and I need to provide the travel agent with my new credit card details. Unfortunately, the only way that they are accepting profile changes is via e-mail! Hence, they are asking me to send full details of the new credit card via e-mail.

Naturally, I refused and they are refusing to update my profile. Am I wrong in refusing to provide details of my credit card via e-mail or are they wrong for being so lax in their IT security procedures? They told me that this process has been approved by their IT and finance departments!

Me? Yes - but then i'm covered for fraud anyway so it's not my problemo if things go south :)

Quote:

---

Originally Posted by Taz

They told me that this process has been approved by their IT and finance departments!

---

Then their IT and finance departments need a swift kick up the arse. The ONLY way that your CC details should be allowed over t'Internet is via a secured, encrypted process, like a secure http (https) session with their web server. Electronic mail is grossly insecure for this purpose. It's plain, unencrypted text which may be stored at any number of mail relays in its path to them. It's practically inviting someone to commit fraud.

No - i just wouldn't do it. It's not secure, and while the risk is tiny in reality, it's still there, and in todays current culture it wouldnt surprise me if any claims you made over losses were refused due to negligence on your part..

take it up with your employer if you have to :)

Yes, I will take it up with my employer. Originally we were asked to fill in a paper form and that was posted to the travel agent. It now appears that they only accept e-mail.

AmEx will point-blank refuse to honour any claim of fraud if i've been negligent enough to send the information via e-mail.

Quote:

---

Originally Posted by Taz

I've just been gobsmacked by a conversation I had with my company's travel agent. I'm not going to name the travel agent as they are a global company.

I travel a lot for my job and my admin books my flights through our travel agent. They hold my credit card details in my profile and they charge all my flights directly to my credit card. They then send me an invoice and I use that as a receipt for my expenses to claim the cost of the flight back from my company.

Although that might seem strange, it works well for me as I get loads of BA miles on my BA/AmEx card.

Anyway, i've got a new credit card now and I need to provide the travel agent with my new credit card details. Unfortunately, the only way that they are accepting profile changes is via e-mail! Hence, they are asking me to send full details of the new credit card via e-mail.

Naturally, I refused and they are refusing to update my profile. Am I wrong in refusing to provide details of my credit card via e-mail or are they wrong for being so lax in their IT security procedures? They told me that this process has been approved by their IT and finance departments!

---

email is slightly less secure than a postcard, in terms of keeping details hidden.

anything you wouldn't write on a postcard for everyone at Royal Mail to gawk at, you don't put in email.

phone them?

or encrypt the email.

Do
not
do
it.

you should never put any sort of persoanl details in emails as god knows who has access to them, id change travel agents if they dont sort it out

i had to email or fax credit card info to the US for a subscription to a Banjo magazine (present for my cousin). Used a one time only card number from Cahoot and faxed it across. Not exactly practical for you though :)

I've asked for a fax number that will go to one person at the travel agent (i.e. not a general fax machine sitting by the water dispenser for example). If they can ensure reasonably secure receipt of a fax then i'm happy to do that.

The problem is that this global travel agent is used by my company as the official travel agent. Hence, I cannot just go to another travel agent. Also, they won't accept a profile change over the phone.

My best bet is to just post a letter to them (as I did before), assuming they will accept this but it seems that they *only* accept profile changes via email, which is truly incredible!

Taz - I seriously think you need to write the company a letter of complaint, and quote several official documents that highlight the insecurity of email, and the gross misinformation that has the potential to endanger the financial details of all of their customers that have used the scheme.

Encouraging someone's customers to email credit card details is surely corporate negligence?

Is this a joke?
I'd prefer to find a shaddy looking man in a pub and hand him £100. Don't be dumb.

I've done it before, but I've split the details into 3 separate emails, better than nothing, but still not recommended..

Dont they have anything like PGP ?

if it's going to the IT department write it in binary. :P

report them to the credit card companies, I'm sure that will movtivate them to change their practice. I would imagine the credit card companies would no longer allow them to use their systems

thats a very good point Pak

Quote:

---

Originally Posted by Taz

...Anyway, i've got a new credit card now and I need to provide the travel agent with my new credit card details. Unfortunately, the only way that they are accepting profile changes is via e-mail! Hence, they are asking me to send full details of the new credit card via e-mail. ...

---

This doesn't make sense, not everyone has email. I'd ask to speak to a manager. How did they get your original credit card details?

Quote:

---

Originally Posted by pak000

report them to the credit card companies, I'm sure that will movtivate them to change their practice. I would imagine the credit card companies would no longer allow them to use their systems

---

This.

It's not being a tell-tale, because you're protecting other people from their details being potentially half-inched.

The thing is that this particular travel agent has thousands upon thousands of customers so i'm quite concerned about the security of the information they hold. By the way, they originally got the info via pen and paper and the postal system. It appears that their procedures have changed recently and only e-mail is acceptable.

This will make you laugh even more but I was too embarrased to mention it in my first post. They originally asked me to SCAN the FRONT and the BACK of my new credit card and E-MAIL the scanned pictures to them. LOL! When I laughed, the person working for this travel agent said that just the credit number and expiry date via e-mail will do if I didn't want to scan the physical credit card.

I expect this kind of thing on April Fools day.

Quote:

---

Originally Posted by Taz

...This will make you laugh even more but I was too embarrased to mention it in my first post. They originally asked me to SCAN the FRONT and the BACK of my new credit card and E-MAIL the scanned pictures to them. ...

---

I have never heard of any company suggesting this, they would have your '3 digit code' as well... is this company based in Nigeria :p

i would report this to Visa and Mastercard if i were you, and escelate it up the company on yourside and theirs. Get some MDs talking about it

Personally, i would say no and not use them again because they sound like total cowboys

silly stupid company, Silly satupid people who do give there details.

This sounds like a story that someone like TheRegister would cover....

I've sent an e-mail to the PA to the MD of my company who is the prime contact for our travel agent within my company. I'm sure she'll sort it.

We've got a large number of customer-facing field-based people and not all of them are technical (even though it's an American software house). Some of them are sales and marketing people ;) Hence, they may not think twice about e-mailing credit card details. Most of the pre- and post-sales consultants probably wouldn't.