Credit Card - Offline Processing - Is this really secure?

Credit Card - Offline Processing - Is this really secure?

It seems to me you are just asking for a fine from the Payment Card Industry by using this, also I may be mistaken.

I believe it is insecure, for the following reasons (including but not necessarily limited to):

• 8 digits not only 4 are store on the server
• it is stored in a plain text database field (not encrypted)
• The 8 other digits are sent through an insecure medium (email)
• The full credit card number will be stored on the server in plain text until the site owner downloads his email (unless he has a seperate email server)
• The cart will still function, and accept a full credit card number, over http, and does not require https
• The expiration date is stored in plain text on the server
• Does not require a separate server for the database that stores the 8 digits of the credit card numbers

Surely the producer of a major ecommerce software would have a high level of security in mind when designing it, for the protection of the store owners using the software, as well as customers purchasing items from a Zencart store.

Could someone from Zencart please comment on if the "Credit Card - Offline Processing" method is secure or not?

And also if its designed to meet the minimum Payment Card Industry Data Security Standards (PCI DSS)?

Thanks in advance!

And also if its designed to meet the minimum Payment Card Industry Data Security Standards (PCI DSS)?

Best answer? No and is the reason it will not be offered in the future.