stormy - 6:18 pm on Dec 9, 2002 (gmt 0)

Hello,

I'm not new around here, but since I hardly post, I always get my account deleted...

I have a friend that runs an online store, and he's been getting credit card details through email for years! It's weird: everything is SSL and the last step is a plain email.

No matter what I tell him, he believes there's no risk at all, because the customer will cancel any suspicious transaction and the bank will protect him. No problems so far. I also think it's very rare that somebody will intercept an email, but I know it's technically feasible.

I've been searching for some "official" security recommendations but can't find anything really specific.

What do you think of his approach?

Thanks,
Jorge