Merchant sent email to me with all my Credit Card info

Question

Is there some place for a consumer to file a complaint concerning improper use of credit card information?

I gave my credit card to a towing company and they sent me a receipt via email with all of my credit card info in the notes field. The email sent is in no way secure.

Is there a government agency where I can file a complaint? I believe my credit card is now compromised and I am going to cancel it and get it reissued. I don't believe this company has a clue about the risk they are placing their company in.

Answer 1

(Note: Not a PCI QSA, just know some PCI and PII stuff)

Violating the Payment Card Industry Data Security Standard is not a violation of the law. The PCI DSS is an agreement between the payment card companies (VISA, etc) and the processors about how data will be secured.

The towing company is likely in breach of an agreement with their processor by doing this - and almost certainly would be more liable in case of leaked information.

If the email indicates the credit card processor, you could contact them. You could also contact the towing company directly. Lastly, as @Matthew suggests, you should let the bank know when you cancel.

A further possibility is to look at the Personally Identifiable Information statutes in your state (assuming you are in the US). PII statutes vary widely depending on your location, but they widely consider the credit card number (known as the PAN) as counting as PII (along with the other personal information presumably in that email). If your location has a privacy commissioner, you could raise it with that department. Most PII statutes have requirements that companies treat PII with appropriate care and there are some significant penalties for not doing so in many jurisdictions.

For PCI, you can look at this info sheet on reporting violations

Answer 2

I'll assume "Government" == "US" since it's NOS.

Is there a government agency where I can file a complaint?

Not really. The government has started to get involved in large breaches, but they don't deal with small things. PCI requirements, which govern the protections merchants must apply around handling card data, are consent-based non-governmental restrictions. You can't get arrested for violating PCI because it's not a law.

You could certainly try to complain to consumer protection agencies, which counts as complaining, but it won't do much.

You could file a lawsuit. It will almost certainly cost you more than you can expect to gain, win or lose.

I believe my credit card is now compromised and I am going to cancel it and get it reissued.

When you do so, make it clear that the reason you're doing so is the unencrypted transmission of plaintext card data by the merchant. There are fines for PCI non-compliance, and the only chance of them kicking in is if there's a breach or if a significant pattern of complaints arises. (That said, for a towing company, the chances of complaints rising to a level that would trigger fines is near zero.)

If you can figure out who they are, and can figure out how to complain to them, you can complain to the merchant's credit card processor. The same caveats apply about nobody listening to onesie-twosie complaints; only patterns of widespread misbehavior are likely to trigger a response.

I don't believe this company has a clue about the risk they are placing their company in.

Well, they aren't really. The system only punishes egregious failures, not line-item non-compliance. Small merchants are effectively on the honor system, and aren't subjected to an impartial audit. It's not fair, but neither is life.

To be honest, it's likely that the most effective response you could have would be to approach the merchant, tell them that sending a PAN (card number) via unencrypted email is not allowed by their credit card processing agreement, and ask them to modify their systems to mask all but the last 4 digits. If you do so in a polite and non-aggressive manner, they might even do it. (If you approach them in a negative or rebuking manner, you should expect nothing to change except their willingness to tow you the next time you break down).

Answer 3

Warning: USA-centric answer, the question asks about a government without specifying a jurisdiction :(

Yes, sort of.

If "all credit card info" includes the expiration date or digits of the card number other than the last five, having that on a receipt is a violation of FACTA, which also allows you to sue them yourself.

The FTC website has details.

The most relevant portions:

According to the federal Fair and Accurate Credit Transaction Act (FACTA), the electronically printed credit and debit card receipts you give your customers must shorten — or truncate — the account information. You may include no more than the last five digits of the card number, and you must delete the card’s expiration date.

and

Noncompliance could open a company up to an FTC law enforcement action, including civil penalties and injunctive relief. In addition, the law allows consumers to sue businesses that don’t comply and to collect damages and attorney’s fees.

But FACTA only applies to "electronically printed" receipts, and the courts found in Simonoff v. Expedia that this doesn't include e-mail.

However, the Gramm-Leach-Bliley Act also requires that businesses safeguard customers' financial information, and the FTC gives a relevant example:

Take steps to ensure the secure transmission of customer information. For example:

• When you transmit credit card information or other sensitive financial data, use a Secure Sockets Layer (SSL) or other secure connection, so that the information is protected in transit.
• If you collect information online directly from customers, make secure transmission automatic. Caution customers against transmitting sensitive data, like account numbers, via email or in response to an unsolicited email or pop-up message.
• If you must transmit sensitive data by email over the Internet, be sure to encrypt the data.

It certainly sounds like they aren't being diligent in this area, and there surely would be no problem with filing an FTC complaint.