In practice, the bad guys are not getting credit card numbers by monitoring unencrypted plain text email connections. They're doing it by getting the information in bulk straight out of databases at the destination (either by hacking or by getting unscrupulous employees to sell them data dumps). My opinion is that the risk factor in sending a CC number over email is much smaller than the risk of giving it to the destination organisation in the first place. And even if you do get unlucky, as a consumer you don't usually end up out of pocket for fraudulent transactions on your card.

I think it's very hard to anticipate how every given person in a large population uses communication tools. When former Florida governor Jeb Bush began his campaign for presidency, he released all the emails he sent/received as governor. This is something mandated by Florida's very open public records laws:

https://www.theverge.com/2015/2/10/8013531/jeb-bush-florida-...

As it turned out, the cache of thousands of emails contained things that are hard to anticipate. Including people emailing their SSN, or talking about their employment/medical issues; the former is possible to filter out computationally, the latter would require manual review and judgment. Bush was criticized, and in response, he took down the emails temporarily until employees could clean them up. But AFAIK, he didn't do anything illegal, because he mirrored exactly what was available from the state official archive which, again AFAIK, did not alter its copy.

This is similar to AOL's release of its search logs. It thought anonymizing user identities would provide anonymity, but they did not realize that some users write very personal things into the search box: https://en.wikipedia.org/wiki/AOL_search_data_leak

Are you really shocked by this? I guess you have never worked on a corporate email system! People do this all of the time.

1) They don't realise email is not secure

2) When you explain point 1, all of the other solutions seem like too much hassle so they email anyway.

3) You can tell your customers not to email you CC numbers, you can even refuse them, but they will keep sending them

...and if you provide online chat with customer support or sales, people will send credit cards in that too. If you have customer accessible support ticket submission system, that will end up with credit cards too.

The Payment Card Industry Data Security Standard (PCI DSS) that you have to agree to follow in order to be allowed to process credit cards requires secure storage of all the cards you store--not just the cards that you intended to store or just cards that come in through channels you intended for receiving cards.

This is a serious issue to take into account when choosing your chat system, ticketing system, and email system because you can't just ignore those wayward credit cards. If you choose systems whose developers did not consider this and failed to provide good tools for finding and redacting unrequested, unwanted sensitive information you will end up having to hack such tools into the system yourself.

That is a very good point

Or they think it's an acceptable risk... $50 liability limit.

That's the thing with credit cards. The merchant always ends up paying.

People laugh at most DLP solutions. I know I used to. But then, I used to think the target was smart people trying to exfiltrate data.

But then I implemented one on a busy mail system, and I started seeing credit card numbers very regularly. I mean, consistently. Even after people have been told why their emails are being bounced and no, I give an "ETA on when it will be fixed".

It's not strange, I too send my cc number and personal information through email because I consider the risk is sufficiently small. Likewise I told people who want to send me these information to just use email

Imagine you are a secretary working at a company where HR is physically located across the country. HR needs you to fill out "Government Form 27" which requires personal information.

You fill out the form, how do you transmit it back to HR? You're probably going to email it. Very few companies have a "secure document transfer system" and very few people understand the risks of emailing personal information.