My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process credit card payments in person and our customers really like this.
Due to the nature of our business (much of the furniture is custom) we don't take the entire payment upfront. We might authorize one amount, capture 60%, and when your goods arrive we re-authorize for the remaining 40%. This is pretty standard and works well. Except some folks aren't keen on meeting up in person for the remaining 40%, and we don't have an option to handle that extra 40% through our website (it would expect a new order).
I've been noticing some of the customers sending such details through email. Some were cautious, sending the number and the dates/cvv code from separate email addresses. Others not so much. Either way, it's not a stellar practice. I brought it up to my wife last night, and she didn't really get why I was making such a big deal about it - after all, she deletes the email as soon as its processed. I said "what if you lost your phone today?" and it clicked in that being insecure for "just a few days" isn't okay, especially if you almost always are in the "just a few days" stage with someone.
At the same time, it would be a pretty poor practice to say "We can't do this thing that's super convenient for you because we can't trust my wife not to lose her phone." - that's basically what our customers would hear. So keeping in mind that we can't rely on our customers being tech savvy at all, what can I use as leverage to convince my customers to not reveal their credit card data over email?
I've read this one about unsolicited emails but the recommendations are vague - "institute a policy", okay. * waves hands * we no longer accept these emails. But, when we are first discussing payment terms, they are likely to ask "can I send you my CC data over email" and when we say no, they will ask "why not"? What can I tell them that doesn't make us look irresponsible and convinces them that it would be best to do it in person with an actual swipe, or if it must be remote, to call us and we can enter it while on the call and it never needs to be recorded anywhere?