How to safely order products on the internet

We have had several of our customers make a mistake on how they order products from us.  They have ordered via email, and have included their credit card data (including expiration dates and security codes) in the email.

This is a very unsafe practice!  All messages on the internet get "bounced" through a large number of relays, and it is eminently possible (actually trivial) to replicate any information as it goes through one of the relays.  Emails are particularly susceptible, since they are usually accumulated until 'complete' at some intermediate area, and then forwarded on.  This means that a copy of the email exists on some other computer somewhere, which was simply acting as a relay.  This information can be retrieved through simple software, if there exists some unscrupulous employee at that intermediate computer or if that computer gets hacked (which happens with dismaying regularity).  This means that credit-card data should never be sent in plain text over an unsecured connection: it cannot be guaranteed to be secure!

Similarly, when ordering on-line, always make certain that you are doing so via a secure connection.  On some browsers (such as Microsoft Internet Explorer), a lock icon will appear at the lower-right corner of the window.  On others (such as FireFox), the address bar will turn yellow.  Regardless, the address will start with the text "https:" (instead of the "http:" which you normally see).  This is a validation that, at the extreme least, the information that you send should be encrypted (and hence be harder to be decoded by a hacker).

If for some reason you do not wish to use our online ordering system, please telephone or FAX us your order, or mail it via the normal U.S. postal mail.  Do not use email!  We cannot guarantee the privacy or security of your data if you send it to us via email.

Normally, if we receive such an order from you by email, we will send you a response which contains most of the information on this page.  We usually will also have you fax us your credit-card based order anyway, (since we will almost always require extra data for validation) so emailing is not a viable option.  The only exception to this is existing customers requesting a new order using a card which they have on file with us.  In that case, however, they merely state "use card on file", which does not pose a security risk.  We still confirm any such sale directly with the customer before we actually go through with it...

Sincerely,

 

    Peter Norberg

    President

    Peter Norberg Consulting, Inc.