Include CC expiration date in confirm email?

**Learning1** · 17 Mar 2009, 06:19 PM

I have a client that is insisting I include the expiration date of the credit card in the order confirmation email. They think going to the admin side of the site is "a waste of time". I have tried to explain to them the "right way" to conduct business but they just don't get it.

Can someone please head me in the right direction to make this happen.

Either the order confirmation or the EXTRA CC NUMBERS email will work.

Thanks in advance for any help.

I am using 1.3.8a

**kobra** · 18 Mar 2009, 12:56 AM

Steer him to PCI/DSS regulations.

If he insists on breaking these rules the CC companies can stop him from processing CC all together.

Sending "Sensitive" CC data via unsecure email is a breach of the rules.

**Learning1** · 18 Mar 2009, 07:55 PM

Thanks so much for the information. I have been reading through the PCI/DDS web site and hope to find a paragraph or PDF that I can send my client. If anyone already has found a PDF or a specific standard on the site - I would appreciate it.

Kobra - thank for again. You have been most helpful.

**kobra** · 21 Mar 2009, 03:01 AM

As I tried to elude to....sending "sensitive" details that a customer intrusts to you via Secure SSL encryption over "insecure" email is just not good business practice and breaks most all rules of maintaining these details in a secure manner...

Look to the rules that are around maintaining records of who can access this information...If emailed then any "hack" could intercept them

**Learning1** · 23 Mar 2009, 12:40 PM

Thanks - to update you on this issue. I met with the client and they were totally unaware of security issues. However it is the classic case of a client getting unfiltered information. They were told by their "computer guy" that they should have the email changed to include the expiration date. Since their "computer guy" must be right - they pushed the issue. The PCI/DSS information you suggested changed that.