Not me, I don’t do fraud guv.

Child 2’s school have had their photos recently and the company they use is a bit archaic. Recommended payment is cheque/postal order but they have included a slip for us to write card details on.

This is full name, address, card number, expiry, but not CVV code. Are they even allowed to do this? I thought PCI-DSS and GDPR had killed this sort of thing off completely.

It breaches the PCI DSS standard that all Aquiring Banks expect and comply with.

In respect to GDPR it is personal not sensitive data, however it will lead to material damage on the data subject (you) if lost.

Tell them to **** off.

I thought the same tbh. Seems bonkers to me, why anyone would want to be handling that sort of data.

Just had a look at their website, it’s a bit 2008 but annoyingly they actually have an online ordering system but not for our school.

Write back, saying you don’t have a cheque book, there’s no nearby post office, but you can do PayPal. Or suggest they update their website so that it includes online orders for child 2’s school.

See what they say to that.

I still see forms issued by charities/businesses that ask for the CVV number mostly aimed at older folks – gardening catalogues etc

Use a payg credit card. Never more than the balance at risk. Avoids compromising your main card.

Sounds like Mail Order, like you used to get in the back of the Sunday papers for plates with the picture of the queen on. If so, then cv2 is not needed as AVS details (house number & numbers from your PC will be used) and the transaction will be one time CNP key entry on their POS.

If they are going to put your credentials on file for future merchant initiated transactions (instalments), then that needs to be stated and agreed by you.

Why not just use a cheque?

Why not just use a cheque?

Its 2022…

Who has a cheque book anymore?

Who has a cheque book anymore?

People who are paranoid about putting their card details on a form – but presumably are fine with their sort code and account number being visible to all!

Big difference between card details and bank acct no/sort code

While I wouldn’t personally do it from a business perspective due to the risk, its not breaking any laws, so its down to how you feel about it. PCI only prohibits the storage (note – not the writing down) of the CVV & mag data. The rest of the card info is fair game as long as its stored/used properly last time I checked.

Would I send the info? Yeah probably, but on a credit card for sure not debit.

Can’t they just provide their account details to allow you to do a bank transfer (and give you a ref number to quote on it)?

Why not just use a cheque?

Its 2022…

Who has a cheque book anymore?

I think I have one in a cupboard underneath some cases of minidiscs, and the player which hasn’t worked for about 18 years. I’m not sure why I still have them or the cheque book.

Can’t you just fax them your details?

Can’t you just fax them your details?

Do telegram boys deliver faxes as well?

.

Who has a cheque book anymore?

I do, somewhere… the date format is from last century __/__/19__
I thought this was cute, till you realise we’re almost a quarter of the way though the 2000’s

You don’t need to buy from them.

Not me, I don’t do fraud guv.

No reason to think its fraud beyond the photographer being selected because they are paying a teacher a kickback…

In this case though presumably the contract was with the school…. who are making it your problem.
I’d offer to send the child in to school with cash (or offer to do do a bank transfer)

I’d be less worried about legality and more worried they have no idea about the risks of losing your card details.

Who has a cheque book anymore?

Me. But only for the milkman these days.

Who has a milkman!

It breaches the PCI DSS standard that all Aquiring Banks expect and comply with.

Risk is with the photographer as if he loses/compromises the card details there’s some quite swinging penalties levied by the card issuer, all on a per card basis not per offence. Lose 4 that’s £100k sir, thank you.

Who has a milkman!

I do, get my Kefir delivered each week. It is all ordered and paid online though.

OP card details for school photographs – no problem for me in the past. Schools did eventually move to the web setup though.

We have a milkman. Have had for >20 years. Very convenient.

I still don’t really understand the problem. If you buy something over the phone, you have to give exactly the same details, plus the security code, to some oik who writes it down at his end. The potential for this to get into the wrong hands seems to be the same, no better or worse.

I think I have one in a cupboard underneath some cases of minidiscs, and the player which hasn’t worked for about 18 years. I’m not sure why I still have them or the cheque book.

I might be interested in the Minidiscs, if you ever want to get rid of them – I’ve got a top-end Sony player/recorder, with fade-in/out and titling with a keyboard. An MDS-JB940.