A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP POS machines with Internet Explorer 8, Flash, Silverlight and Java with pretty much unrestricted internet access (used on a daily basis by the employees to lookup information on Google).
Note that payments are handled separately by card terminals provided by a bank (which I believe are secure enough), but nevertheless the procedure is to first swipe the customer's card through the POS machine first, possibly for analytics. When selling some specific products a credit check is required which also asks for the customer's details and more card info like the CVV2.
I believe this is pure madness but I would like to ask for expert's advice - am I overreacting or are there specific circumstances that I overlooked that would make this safe? And if I am correct, who should I report this to?
