12

Call me paranoid, but should I give me 16 digit card number and expiry date by email to a (well known) company, or push for a cheque?

They really messed up and I have had to push to get this far, but do not want to give away such details to a useless company. Am I over thinking this? They have not asked for the last three digits on the back of the card.

I used a credit card to pay but whilst I have proof and they agree to a refund they want my card details.

12
  • 8
    Ask them if they can do it over the phone ? Email isn't safe to send in card details, and a well known company should know so.
    – DumbCoder
    Aug 12, 2016 at 12:07
  • 14
    A credit card merchant is required to give refunds by the same method as payment was taken to prevent fraud.
    – JamesRyan
    Aug 12, 2016 at 15:39
  • 3
    @indofraiser no because a cheque would allow the payment to be taken from the cardholder and refunded to a 3rd party fraudster. The cardholder could then dispute the charge and the merchant would have to pay out a 2nd time and be left out of pocket.
    – JamesRyan
    Aug 12, 2016 at 15:47
  • 2
    @Merhdad Poor advice. There's no security in that. If you have no other choice but to give it in an email, send it in two halves in separate emails.
    – user207421
    Aug 13, 2016 at 0:18
  • 1
    Consider emails to be as secure as postcards... Every postal worker along the way can see who it's to/from and the content. Never, ever include details in an email that you wouldn't be happy to hand over to total strangers.
    – Basic
    Aug 13, 2016 at 11:10

6 Answers 6

24

If it is a well known company that wants to give you a refund, I would not worry about giving them your credit card number.

However, I would never type my credit card number into an e-mail message. E-mail messages are very insecure, and can be read by many people along its way to the destination. They also can be archived in many places, meaning that your number will continue to be posted out there for someone to grab in the future.

If you need to give this company your credit card number, do it over the phone.

Having said that, ultimately you are not generally responsible for fraudulent charges if your card number is stolen and misused. I've had so many fraudulent charges, despite my being relatively careful with my number, that I don't really worry much anymore about losing my number. I just check my statement for false charges, and when they happen, the bank cancels the charge and issues me a new number. It has happened to either my wife or I maybe 5 times over the last two years.

9
  • 3
    Please clarify that this is the case in the US. You are certainly generally responsible for fraudulent charges on your card in the EU and I have no clue what the situation is in the rest of the world.
    – DRF
    Aug 12, 2016 at 14:22
  • 6
    @DRF generally responsible for fraudulent charges on your card in the EU No not for credit cards. For debit cards yes, but that depends on how careless you were wrt the bank's T&Cs.
    – DumbCoder
    Aug 12, 2016 at 14:38
  • 9
    5 times in 24 months is a lot! Maybe if you were more careful with your number you wouldn't need to go through this hassle so often.
    – Myles
    Aug 12, 2016 at 14:58
  • 2
    @DumbCoder It's nowhere near as clear cut as you say. While chargebacks are possible on both types of card in theory in many countries they are hard to negotiate and not all banks are really willing to provide them without serious effort. It's nowhere near the easy breezy you're only liable for 50$ that it is in the US. It depends somewhat on country and bank but many banks in for example the czech republic will specifically point out that they are only liable for charges occurring after cancellation.
    – DRF
    Aug 12, 2016 at 15:03
  • I have upvoted probably 50 of your answers but I really really disagree with this one.
    – blankip
    Aug 12, 2016 at 16:20
12

I used to work for a online payment posting company. Anytime a payment is made via Credit Card to a company that does not have PCI DSS(aka the ability/certification to store credit card information) there is a MD5 checksum(of the confirmation code, not the Credit Card information) that get sent to the company from the processor(billing tree, paypal, etc). The company should be able to send this information back to the processor in order to refund the payment.

If the company isn't able to do this, to be honest they shouldn't be taking online credit card payments. And by all means do not send your credit card information in an email. As said above, call the company's customer service line and give them the info to credit your account.

4
  • 1
    Are you sure it is md5? Credit card numbers are only 16 digits, should be valid with Luhn checksum, and Visa, Master, etc usually have first 2-5 numbers predefined. If the company is storing card numbers as MD5, it will only take a few hours to figure out the card number. </end-of-unrelated-comment>
    – AKS
    Aug 14, 2016 at 18:19
  • 1
    @AyeshK Yep. MD5 is insecure in general and you definitely shouldn't be hashing small inputs like card numbers! A good payment processor returns either a random identifier or an index into their table of card numbers you have submitted.
    – Navin
    Aug 14, 2016 at 20:09
  • @AyeshK - Some years ago I discovered that one of the UK's largest payment providers wasn't even using MD5 for their payment verification hashes sent to the merchant -- they were generating a string based on the transaction details and encrypting it by adding the characters of the (equal length) key of the merchant modulo 26. With just a handful of verification codes (which are sent to the purchaser as well as the merchant) I was able to determine the merchants' keys. Don't trust payment service providers to actually be secure. They don't really care, they just implement the bare minimum.
    – Jules
    Aug 15, 2016 at 6:38
  • CC numbers wouldn't be stored as MD5, but rather the confirmation codes that the processors would send us for validation purposes.
    – seroki
    Aug 16, 2016 at 16:00
9

Personally, I would just dispute this one with your CC. I had a situation where a subscription I had cancelled the prior year was billed to me. I called up to have a refund issued, they couldn't find me in their system under three phone numbers and two addresses. The solution they proposed was "send us your credit card statement with the charge circled," to which I responded "there's no way in hell I'm sending you my CC statement." Then I disputed the charge with the CC bank and it was gone about two days later. I partially expect to have the same charge appear next year when they try to renew my non-existent subscription again.

Now, whether or not this is a normal practice for the company, or just a call center person making a good-faith but insecure attempt to solve your problem is irrelevant. Fact of the matter is, you tried to resolve this with the merchant and the merchant asked for something that's likely outside the bounds of your CC Terms and Conditions; sending your entire number via email.

Dispute it and move on. The dispute process exists for a reason.

2
  • 2
    Yes, that's the right way to handle it. Give them an opportunity to refund you (which costs them nothing). If they balk, call your bank and get a chargeback. They get stuck with a $20+ charge, but it's motivation to fix their customer service issue. Very often the "issue" is they figure they make more money stonewalling legitimate refund requests because so many people just give up. I wouldn't have a problem sending my CC statement, I'd just stick Post-It notes over the sensitive info. Aug 13, 2016 at 1:56
  • 1
    I was in this exact situation and ended up letting my credit card handle it. A hotel in the UK overcharged me and agreed to refund me via email if I emailed them my card number. I asked them for a phone number instead of emailing my card number, it took them a week to respond, I made 3 attempts at calling (during their business hours), they never returned my calls, so finally I just disputed the charge with my credit card company, gave them all of the information (including the emails from the hotel) and they took care of it.
    – Johnny
    Aug 13, 2016 at 21:48
4

While I agree with Ben a lot I feel like his answer is really poor here.

You do not call a number to give your credit card information out for a refund. That is ridiculous. Just from his answer - he has had 5 cases of fraud lately - you should know that you shouldn't follow this advice.

I personally don't ever give my credit card number over the phone, unless it is the very very very last resort. It is not just about money and safety but it is about time. Every time that you give your number out over the phone there is a chance that the employee on the other end (by either scam or legitimate business) will use or sell your info. So you need to determine if the time saved by doing a transaction over the phone is worth hours/days of your time if your card has a fraud issue. And note that fraud sometimes is easily negated, but if done smartly can be hard to prove via a quick call or email to card company.

What should you do?

Tell company that you will simply get the refund through your credit card company.

And if we go back to time element... You fill out form on card website. Card company goes back to vendor and says - "Why are you asking for card numbers via email?" Card company either cancels vendor contract or more likely helps them understand the technology available so they don't have to do this. Therefore that quick form that you filled out will now keep this company from bugging you again. By going through their archaic "systems" you are enabling their behavior.

1
  • 5
    I understand your point, but in my experience, when you have a merchant that wants to give you a refund, you get faster and better results working directly through the merchant than you do going through the card company. Card company requests are for when you and the merchant have a dispute on what needs to be done. YMMV. Aug 12, 2016 at 16:47
4

It's a scam. Or they're really dumb.

A bona-fide company never needs your credit card details, certainly not your 3-digit-on-back-of-card #, to issue a refund. On an older charge, they might have to work with their merchant provider. But they should be able to do it within the credit card handling system, and in fact are required to.

Asking for details via email doesn't pass the "sniff test" either. To get a credit card merchant account, a company needs to go through a security assessment process called PCI-DSS. Security gets drummed into you pretty good. Of course they could be using one of the dumbed-down services like Square, but those services make refunds ridiculously easy.

How did you come to be corresponding on this email address? Did they initially contact you? Did you find it on a third party website? Some of those are fraudulent and many others, like Yelp, it's very easy to insert false contact information for a business. Consumer forums, even moreso. You might take another swing at finding a proper contact for the company.

Stop asking for a cheque. That also circumvents the credit card system. And obviously a scammer won't send a check... at least not one you'd want!

If all else fails: call your bank and tell them you want to do a chargeback on that transaction. This is where the bank intervenes to reverse the charge. It's rather straightforward (especially if the merchant has agreed in principle to a refund) but requires some paperwork or e-paperwork.

Don't chargeback lightly. Don't use it casually or out of laziness or unwillingness to speak with the merchant, e.g. to cancel an order. The bank charges the merchant a $20 or larger investigation fee, separate from the refund. Each chargeback is also a "strike"; too many "strikes" and the merchant is barred from taking credit cards. It's serious business.

As a merchant, I would never send a cheque to an angry customer. Because if I did, they'd cash the cheque and still do a chargeback, so then I'd be out the money twice, plus the investigation fee to boot.

1
  • 2
    I agree that this is potentially a scam. Why would a "well-known" company need your card information to issue a refund when they should have it on file in the first place.
    – NuWin
    Aug 13, 2016 at 4:25
0

Definitely push for a check, they may not do anything nefarious with your credit card number however someone else may be able to read the email before it gets to its final destination. It's never safe to give out credit card number in a less than secure interface. Also, if this is a well known company, then the person interacting with you should know better than to ask for your information through email.

2
  • Merchants are not allowed to refund by check. You have to use the same payment network to issue a refund.
    – Navin
    Aug 14, 2016 at 20:11
  • It depends on the company. I have bought things with a card before and had a refund issued by check.
    – CSRenA
    Aug 14, 2016 at 20:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .