What is positive wording for telling donors we no longer accept card information in writing, for their security?
I'm assuming this is to avoid having to take special physical security precautions for all of your correspondence to comply with PCI-DSS (if you aren't sure what that is, then I've made a bad assumption). For the benefit of other readers, PCI-DSS is not limited to computer security; it also covers telephone sales and other low-tech physical methods, right down to the venerable "knuckle-buster".
How will you accept their card information? Over the phone, on a secure web site, etc? I would emphasize the approved secure methods of supplying payment card information first, and then either not even mention other methods you won't use, or if you must, simply convey that your bank will not accept card information obtained any other way.
The basic principle in user messaging is empathy - don't tell the user they are wrong. Instead, figure out what the user's trying to do, and tell the user how to do it.
I see you're trying to submit your credit card. The only way we can accept credit card payments is through our HTTPS portal found here: www.example.com/payment.