Sending Credit Card Details by email

humfer

Just booking a load of hotels for a trip to New Zealand later this year and several hotels are asking for credit card details to be sent by email to confirm booking. This doesn't sound very safe to me. Anyone got any advice?

KTF

To be honest it wouldnt worry me in the slightest but if you have a concern you could always phone them up or ask if they accept a cash transfer instead.

Stompa

humfer wrote:

Anyone got any advice?

Yes, don't do it. Credit card details should NEVER be sent by email.

headcovers

It is definitely unwise to send your credit card details via e-mail. In reality, e-mail travels between computers pretty much like a postcard travels through the post. It can be intercepted and read by parties you're unaware of along the way (unless you're using some form of e-mail encryption that not many people bother with). Sending your details by e-mail also means that an electronic copy of those details is on your machine, and is probably saved on someone else's as well. This means that if your computer (or theirs) is hacked or stolen, someone else may be able to retrieve the details and put them to nefarious use.

Some people recommend sending credit card details broken up into two or more separate e-mails. This might reduce the risk a little, but not much more than doing the same thing with two or more postcards through the post.

bert&ernie

you could argue that it is actually more secure to write your cc details on the back of a postcard and send it by airmail!

Hazzanet

I've been booking hotels in Finland and Switzerland lately. What I tend to do is negotiate the price and dates by e-mail and then fax them a written booking request along with credt-card details. Alternatively, you can follow up by post, but it's certainly not as quick as a fax.

Hazza

Astaroth

Where ever you use your credit card there is a risk of the number being intercepted - be it a postman who opens your credit card bill/ mail order payment or someone with a sniffer program running trying to catch credit card numbers.

Sending the number by unsecured email is one of the riskier things to do. I personally would either phone or fax the number to them but saying that the chances of it actually being intercepted are actually very low

James

Why not ask your credit card issuer what they advise?

Post their reply.

There's little advice either about using your card details to order goods using a public computer, or using a public computer to access your bank account.

As for email addresses:

http://www.securitypronews.com/news/securitynews/spn-45-20060718YahooMailPopularWithFraudsters.html

bengal-stripe

If you're worried, leave something essential out (last four numbers or expiry date) and send everything else by e-mail.
Then phone a day later and give the last details.

Voyager2002

Don't the hotels have their own (secure) web sites?

tuux1598g

Certainly don't send C/C details via email - this is asking for your card to be used fraudulently, you have no clue where the email may end up (on somebody's private computer, on a shared computer in an office, on a shared hosting server with 150+ other users or even on multiple combinations of the above) and emails are so easily intercepted and read as they are simply sent over the internet as plain text and may pass through many 'untrusted' points to reach their destination. Email is best used simply for basic communication, and not for sensitive data of any type - this is where Secure websites come into their own as there isn't really an alternative way to send C/C details over the internet safely (at least not that an everyday user would be happy with).

Why do you think your online banking service don't send passwords via email and choose to use conventional post instead

In my opinion, any Ecommerce business that is asking for you to send details via email obviously has no clue about the risks involved and therefore I would not trust them to have any clue where other aspects of credit card security and IT come into play (such as keeping this data secure once they are holding it in a database, physical security etc.). I would go elsewhere if it were me in this situation.