Call me paranoid, but should I give me 16 digit card number and expiry date by email to a (well known) company, or push for a cheque?
They really messed up and I have had to push to get this far, but do not want to give away such details to a useless company. Am I over thinking this? They have not asked for the last three digits on the back of the card.
I used a credit card to pay but whilst I have proof and they agree to a refund they want my card details.
If it is a well known company that wants to give you a refund, I would not worry about giving them your credit card number.
However, I would never type my credit card number into an e-mail message. E-mail messages are very insecure, and can be read by many people along its way to the destination. They also can be archived in many places, meaning that your number will continue to be posted out there for someone to grab in the future.
If you need to give this company your credit card number, do it over the phone.
Having said that, ultimately you are not generally responsible for fraudulent charges if your card number is stolen and misused. I've had so many fraudulent charges, despite my being relatively careful with my number, that I don't really worry much anymore about losing my number. I just check my statement for false charges, and when they happen, the bank cancels the charge and issues me a new number. It has happened to either my wife or I maybe 5 times over the last two years.
I used to work for a online payment posting company. Anytime a payment is made via Credit Card to a company that does not have PCI DSS(aka the ability/certification to store credit card information) there is a MD5 checksum(of the confirmation code, not the Credit Card information) that get sent to the company from the processor(billing tree, paypal, etc). The company should be able to send this information back to the processor in order to refund the payment.
If the company isn't able to do this, to be honest they shouldn't be taking online credit card payments. And by all means do not send your credit card information in an email. As said above, call the company's customer service line and give them the info to credit your account.
Personally, I would just dispute this one with your CC. I had a situation where a subscription I had cancelled the prior year was billed to me. I called up to have a refund issued, they couldn't find me in their system under three phone numbers and two addresses. The solution they proposed was "send us your credit card statement with the charge circled," to which I responded "there's no way in hell I'm sending you my CC statement." Then I disputed the charge with the CC bank and it was gone about two days later. I partially expect to have the same charge appear next year when they try to renew my non-existent subscription again.
Now, whether or not this is a normal practice for the company, or just a call center person making a good-faith but insecure attempt to solve your problem is irrelevant. Fact of the matter is, you tried to resolve this with the merchant and the merchant asked for something that's likely outside the bounds of your CC Terms and Conditions; sending your entire number via email.
Dispute it and move on. The dispute process exists for a reason.
While I agree with Ben a lot I feel like his answer is really poor here.
You do not call a number to give your credit card information out for a refund. That is ridiculous. Just from his answer - he has had 5 cases of fraud lately - you should know that you shouldn't follow this advice.
I personally don't ever give my credit card number over the phone, unless it is the very very very last resort. It is not just about money and safety but it is about time. Every time that you give your number out over the phone there is a chance that the employee on the other end (by either scam or legitimate business) will use or sell your info. So you need to determine if the time saved by doing a transaction over the phone is worth hours/days of your time if your card has a fraud issue. And note that fraud sometimes is easily negated, but if done smartly can be hard to prove via a quick call or email to card company.
What should you do?
Tell company that you will simply get the refund through your credit card company.
And if we go back to time element... You fill out form on card website. Card company goes back to vendor and says - "Why are you asking for card numbers via email?" Card company either cancels vendor contract or more likely helps them understand the technology available so they don't have to do this. Therefore that quick form that you filled out will now keep this company from bugging you again. By going through their archaic "systems" you are enabling their behavior.
A bona-fide company never needs your credit card details, certainly not your 3-digit-on-back-of-card #, to issue a refund. On an older charge, they might have to work with their merchant provider. But they should be able to do it within the credit card handling system, and in fact are required to.
Asking for details via email doesn't pass the "sniff test" either. To get a credit card merchant account, a company needs to go through a security assessment process called PCI-DSS. Security gets drummed into you pretty good. Of course they could be using one of the dumbed-down services like Square, but those services make refunds ridiculously easy.
How did you come to be corresponding on this email address? Did they initially contact you? Did you find it on a third party website? Some of those are fraudulent and many others, like Yelp, it's very easy to insert false contact information for a business. Consumer forums, even moreso. You might take another swing at finding a proper contact for the company.
Stop asking for a cheque. That also circumvents the credit card system. And obviously a scammer won't send a check... at least not one you'd want!
If all else fails: call your bank and tell them you want to do a chargeback on that transaction. This is where the bank intervenes to reverse the charge. It's rather straightforward (especially if the merchant has agreed in principle to a refund) but requires some paperwork or e-paperwork.
Don't chargeback lightly. Don't use it casually or out of laziness or unwillingness to speak with the merchant, e.g. to cancel an order. The bank charges the merchant a $20 or larger investigation fee, separate from the refund. Each chargeback is also a "strike"; too many "strikes" and the merchant is barred from taking credit cards. It's serious business.
As a merchant, I would never send a cheque to an angry customer. Because if I did, they'd cash the cheque and still do a chargeback, so then I'd be out the money twice, plus the investigation fee to boot.
Definitely push for a check, they may not do anything nefarious with your credit card number however someone else may be able to read the email before it gets to its final destination. It's never safe to give out credit card number in a less than secure interface. Also, if this is a well known company, then the person interacting with you should know better than to ask for your information through email.
