Full credit card details via email for restaurant booking
Discussion
Hi guys,
I'm in the process of booking a table for 12 people at restaurant for a date in May.
I've just received what can only be called a contract. I have no issues with their cancellation terms, duration and cost are reasonable (£15pp if cancelled within 48 hours), but what I do object to is their request for full credit card details (including 3 digit CV2 number) to be entered into a Word document and then emailed back to them.
This means I will effectively be handing over my credit card via unsecured email for them to keep on file until May. Ignoring the clear PCI DSS compliance issues is this a reasonable request?
They can take the long number from me, but giving out the whole lot so far in advance seems crazy.
I've not been able to contact the reservation person, so I thought I'd post on here and see what you lot think.
Whaddya reckon, eh?
I'm in the process of booking a table for 12 people at restaurant for a date in May.
I've just received what can only be called a contract. I have no issues with their cancellation terms, duration and cost are reasonable (£15pp if cancelled within 48 hours), but what I do object to is their request for full credit card details (including 3 digit CV2 number) to be entered into a Word document and then emailed back to them.
This means I will effectively be handing over my credit card via unsecured email for them to keep on file until May. Ignoring the clear PCI DSS compliance issues is this a reasonable request?
They can take the long number from me, but giving out the whole lot so far in advance seems crazy.
I've not been able to contact the reservation person, so I thought I'd post on here and see what you lot think.
Whaddya reckon, eh?
I'd ask them who their card merchant agreement is with, before giving them any card details.
Have a quick chat to their card processing customer service people to check that these details have been requested in a plain text email attachment, and are they happy with that, and go from there...
I'd also be concerned that these attachments are likely to be saved somewhere (or printed out and filed) and there's a great opportunity for a dodgy employee to make a bit of cash on the side by flogging these (or using them)
To use that Bannatyne phrase ; "I'm out"...
Find somewhere else to dine. (I run a pub / restaurant and wouldn't dream of doing that)
Have a quick chat to their card processing customer service people to check that these details have been requested in a plain text email attachment, and are they happy with that, and go from there...
I'd also be concerned that these attachments are likely to be saved somewhere (or printed out and filed) and there's a great opportunity for a dodgy employee to make a bit of cash on the side by flogging these (or using them)
To use that Bannatyne phrase ; "I'm out"...
Find somewhere else to dine. (I run a pub / restaurant and wouldn't dream of doing that)
It's illegal for them to process your card details like that - we used to be able to hold pax card info and just take payments when we were owed money but nowadays, unless you agree to a payment being taken on a set date, the card holder MUST be present when the transaction is made whether that be via chip and pin or over the phone.
Phew - I was half expecting to be told I was being an idiot!
It's a provincial restaurant run by a London organisation, so I was half expecting something like this. I eat at their restaurant near Smithfields and it's very good indeed, plus the only real alternative is a crappy curry house.
From the restaurant's perspective they are going to want to be able to charge me without further consent or contact if I do renege on the booking - they simply can't do this any more with just the 16 digit number.
From my perspective if they are going to 'file' it electronically then for my security they should be fully compliant with the PCI DSS guidelines, although being vaguely conversant with these guidelines I suspect they wouldn't be!
If they ask me to print and post it then I have absolutely no control over the information once I put it in the post box.
I suppose I should actually pick up the phone and raise my concerns rather than just posting about it on PH....
It's a provincial restaurant run by a London organisation, so I was half expecting something like this. I eat at their restaurant near Smithfields and it's very good indeed, plus the only real alternative is a crappy curry house.
From the restaurant's perspective they are going to want to be able to charge me without further consent or contact if I do renege on the booking - they simply can't do this any more with just the 16 digit number.
From my perspective if they are going to 'file' it electronically then for my security they should be fully compliant with the PCI DSS guidelines, although being vaguely conversant with these guidelines I suspect they wouldn't be!
If they ask me to print and post it then I have absolutely no control over the information once I put it in the post box.
I suppose I should actually pick up the phone and raise my concerns rather than just posting about it on PH....
Just spoke to their booking manager - she was most apologetic, apparently the booking forms for the London restaurants have recently changed and don't request full details. They should have sent me one of those.
She dealt with it all very well, will pass on my comments to their head office and was happy to confirm the booking without taking any payment info.
I'll look forward to honouring my booking at the Hix Oyster & Fish House in Lyme Regis.
She dealt with it all very well, will pass on my comments to their head office and was happy to confirm the booking without taking any payment info.
I'll look forward to honouring my booking at the Hix Oyster & Fish House in Lyme Regis.
Gassing Station | Food, Drink & Restaurants | Top of Page | What's New | My Stuff