What is positive wording for telling donors we no longer accept card information in writing, for their security?

  • 1
    I'm not seeing a security question here. This is a PR question. I'd also suggest that "for their security" needs to be understood and explained, which you do not explain to us. How is this measure for their security? – schroeder Aug 29 '19 at 6:39

I'm assuming this is to avoid having to take special physical security precautions for all of your correspondence to comply with PCI-DSS (if you aren't sure what that is, then I've made a bad assumption). For the benefit of other readers, PCI-DSS is not limited to computer security; it also covers telephone sales and other low-tech physical methods, right down to the venerable "knuckle-buster".

How will you accept their card information? Over the phone, on a secure web site, etc? I would emphasize the approved secure methods of supplying payment card information first, and then either not even mention other methods you won't use, or if you must, simply convey that your bank will not accept card information obtained any other way.

|improve this answer|||||
  • It must be my warped mind, but "having to take special physical security precautions for all of your correspondence" conjures-up a new attack vector: PDOS (postal denial of service): flooding a company with letters containing credit-card numbers / PII :-) – TripeHound Aug 29 '19 at 7:53

The basic principle in user messaging is empathy - don't tell the user they are wrong. Instead, figure out what the user's trying to do, and tell the user how to do it.

I see you're trying to submit your credit card. The only way we can accept credit card payments is through our HTTPS portal found here: www.example.com/payment.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.