From what you've said, he clearly does not understand the enormous size of the risk he's taken with this. I assume that if he is doing shopping for other people, those other people are wealthy, and have high dollar limit (possibly unlimited) credit cards. He needs to be aware that if this data is stolen, he will be personally held liable for all the fraud committed.
If he has the cards of 10 million-dollar clients, he needs to treat these card numbers as if they were $10 million worth of diamonds. He should keep them on a piece of paper, locked in a safe. If it were me asking one of my employees to use a card, I would have them come into my office and ask me to type in the card number for them, instead of giving the card numbers away.
Some other piece of bad news is that if one of his clients' cards is stolen somewhere else (at a restaurant or gas pump skimmer), and if Visa learns he has stored these card numbers, they may hold him liable anyway -- even if he had nothing to do with the actual theft or fraud.
Making it easy to get at should be the opposite of what he wants. He should instead be paranoid about who can get to this list.
Since he is lacking the security basics (demonstrated by failing to understand the value of what he's been entrusted with) I further doubt his ability to maintain a secure computing environment. He needs to understand that he can't afford to trust this information to a computer that could be hacked in exchange for a little convenience.