Ask HN: Is it safe to send credit card details via email (as WireX does)?
I recently signed up to WireX, a digital wallet/banking platform, based in London, that offers debit cards (virtual and plastic). They sent me the complete credit card details for my virtual VISA card (name, number, expiry, CCV) via normal unencrypted email (at my domain, not gmail to gmail or so), which I would still think to be somewhat of a no-no.
I understand that password resets often go to your email. But is it really considered best practice (or even just defensible) to send credit card details by email?
Edit to add: Website: https://wirexapp.com
(
13 comments
| 15 points
| on HN
)
It reminds me of those websites that send you your password directly without encryption or anything. I also make it a point to send a user, who forgot their password, an actual link to reset their password through the website. If they forgot their old password, they must have not wanted to remember it, and it is technically not our responsibility to remember their exact password. Of course, I could probably get the system to send them their unencrypted password, but I think it is unsafe practice. Instead, I just send a link that takes them to a page where they can change it completely.
As far as personal information, that stays within my https website, either in invoices stored on the website or a single printable page that shows the transaction occurred. A person can easily save it or email it to themselves [at a later time], but that is an option I provide in which they are responsible for the information in their email now, because they personally had to click a button to have it sent there, rather than me automating important personal information to their email.
My responsibility is to provide the product and make sure it works for my clients. As far as payments go, I put that on a payment processor and I never save that information, so in essence, the most information I have is: account information and the fact that a transaction took place. That is the best way to increase your security is by keeping minimal information and simply not having to be the one fully responsible for it at all.
Don't use this startup's products, not now, not ever. They've already revealed their true colors as obviously not just not caring, but not even really having the capacity thinking about security, which is even worse. And they're a financial/banking startup! Geez.
>© 2016 Wirex Limited (CRN 09334596) 25 Old Broad Street, London, EC2N 1HN, UK.
The card is issued by Wave Crest Holdings Limited, a licensed electronic money institution by the Financial Services Commission, Gibraltar.
Site:
http://www.wavecrest.gi/
More info here:
http://www.wavecrest.gi/about-2/
http://www.wavecrest.gi/platform/fraudrisk-management/
Maybe the mail was pass-through?
Wirex card is Visa.
Please mind that:
- All cards ordered prior Dec 22, 2015 are Visa (both virtual and plastic).
- All cards ordered in the period from Dec 22, 2015 to Feb 10, 2016 are MasterCard (both virtual and plastic).
- Cards ordered between Feb 10, 2016 and Apr 15, 2017 are Visa for virtual and MasterCard for plastic.
- All cards ordered after Apr 15, 2017 are Visa (both virtual and plastic).
The personal shoppers were sending customer purchase data--credit card, name and address details--through email, and those emails were being stored (somewhat unconventionally) in a major customer support platform.