How secure is it to send credit card information partially over email and text?

Question

I need to pass credit card information for a travel reservation, and I am thinking of splitting it over email and text. The credit card number itself would be send over text, while expiration date and verification number would be send over email. How would you evaluate this technique in terms of security?

Answer 1

Technically not secure, although as a result of a push by Google in the last couple of years, most (90 % ish) server-to-server email relays now use an encrypted connection, but it's still clear text on each server.

If you're going to provide the info, doing so by a voice call is probably as practical as possible.

Since you're already considering email for a piece, I suggest simply encrypting the email.

Ideally all parties would be familiar with using PGP/GPG for encryption, but unfortunately this is unlikely. Instead, put it in a file and ZIP it with a password. Most people know how to handle ZIP files. You still need to deliver the password out-of-band but you can do that with a voice call or depending upon the relationship with a cryptic reference common to you both.

Answer 2

Both SMS and email don't use encryption and aren't authenticated, so technically they are not secure. However, in practice it is unlikely that your credit card number will be compromised.

Assuming you know this other person well, a slightly better way would be to pass information by phone. This way, you at least know that the recipient is who you think it is.

Normally, credit card companies have protection against abuse and are quite lenient in giving you your money back if your card is abused. However, if you willingly give your number and verification number to another party this may change things.