I was shopping online and I could not buy the desired item, I could only make a request. After that, I received an email from the dealer:

“If you would like to proceed, please fill out the enclosed authorization form and email it back along with copy/picture of your credit card front and back and driver’s license (all required by the Finance Dpt.). Also please provide the complete street address, telephone and email."

In this “attached authorization form” (just a .doc file) I have to write all the numbers on my credit card, including billing address and card identification number.

Looks like too much information about me. Is this normal?

  • "online dealer" of what? buying what? check for yourself what it looks like opening a brokerage/investment account at a respectable major firm (vanguard or whatever). They do KYC/AML, but not like that.
    – Z.T.
    Commented Jun 23, 2019 at 2:54
  • Also, since this is information security stack exchange, don't open doc file attachments on a pc directly. Open them on an iOS device or upload them to a google drive and open them there.
    – Z.T.
    Commented Jun 23, 2019 at 2:57
  • It's just a fragrance. Sure, I didn't download this file
    – Ellen
    Commented Jun 23, 2019 at 3:08
  • All of that is not normal, I suggest you find another place that sells the item. They should use a credit card processor like Stripe or PayPal (where the shop doesn't get your credit card details), and they don't need your id.
    – Z.T.
    Commented Jun 23, 2019 at 3:11
  • 2
    If I were you I would report this seller to the authorities. Commented Jun 23, 2019 at 4:50

2 Answers 2


Run away!

The only information an online shop should need is address (delivery or invoice, one of which needs to match the card), cardholder name, card number, expiry date and CVV on the back.

Your card issuer will handle any additional authentication - and there's new regs coming in over the next few months to tighten up on this - and this does not go back through the merchant.

The only reason I could think of for additional info like drivers licence or utility bill is you're opening a line of credit with them and they're running a credit check, buying age-restricted items or something that needs a licence to purchase.


When you go to purchase something online, I assume you look for the HTTPS lock to verify that the credit card information you provide is protected in transit by encryption?

Same for any other PII information you may need to provide.

Why then would you go out of your way to construct an insecure email of all of that information, bypassing all basic security?

This makes no sense!

This is a strong indication that the organization you're dealing with is at least incompetent if not malicious.

On the other hand, I've seem some pretty strange ... stuff ... over the years.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .