Is it safer to send credit card number via unsecured website form or by e-mail? What safer options are there?
Buy a prepaid gift card, such as a MasterCard or Visa gift card. You can find them at the grocery store, a pharmacy, or your local bank. Provide this on their online form. If anyone steals your gift card information, you will have already used the funds for your purchase and there is no further risk to you. Some (most) credit cards have a way to get a one-time use number. If that is an available option for one of your cards, that is probably the way to do the very risky transaction. These numbers can be good for only one purchase, or for multiple purchases with a single vendor. This will limit your exposure because they won't have access to your entire account. Also review your fraud protections with your credit card. With the single use number, it won't matter if you use the electronic form or the email. Just make sure you keep the confirmation email or a screen capture of the form. Here's one option:  Telephone is a lower-tech yet relatively more secure means for transmitting your payment information when a secure web site isn't available. And yet another option:  You could send them an encrypted email, but this would require tools (e.g. GPG), setup (public keys), and expertise on their end which they are unlikely to already have. However, ChrisInEdmonton raised a good point in his comment.  How can you consider them to be a reputable seller when they don't take basic precautions to protect customers' payment information online? The seller may with good faith charge your card the correct amount and deliver the goods that you expect, but how will they protect your credit card information once in their hands?  Would you trust their internal systems if they can't even set up an HTTPS web site? "Most people cannot use pgp/gpg and setting it up would, in order to do that correctly, require voice fingerprint verification. Don't. Just write a word doc and either encrypt it when saving using the ""save as"" function or encrypt it using zip and email that to them. Then call them and tell them the password. Done." "Your biggest risk with a vendor like this is not that your Credit Card Number will be stolen in transit, it is that it will be stolen from the vendor. I agree with @mhoran that using a one-time number is the best plan, provided you have a bank that offers such numbers.  Bank of America calls it ""Shop Safe"" while Citibank calls it ""Virtual Account Numbers"".  I think Discover card has something similar, but less useful, in that they aren't really one-time use, and I think American Express discontinued their service.  AFAIK no one else offers anything like it.  If you can't get a one-time number, then I was going to suggest buying a Visa gift card, until I put together the fact that you are making a purchase in Asia and the gift cards are not authorized for international payments (due to PATRIOT act restrictions).  Visa does offer the V.me service which might help, but I doubt your vendor participates (or would even be allowed to participate) if they don't offer a secure order form.  You can open a pre-paid Visa card account, which is probably what I'd do. You can buy pre-paid Visa cards the same way you buy Visa gift cards, the difference being you have to register the pre-paid cards (thanks, PATRIOT act) before you can use them.  But it's not that big a deal to register one, you just fill out the online form your your SSN etc and you're good to go. Load it up with enough money to cover your purchase and the FX fees and then cut it up."
Some already mentioned that you could pay with your savings and use the credit card as an emergency buffer. However, if you think there is a reasonable chance that your creditcard gets revoked and that you need cash quickly, here is a simple alternative: So could someone working at your bank directly.  Of at your HR department at work.  Most of the wait staff at the restaurant I ate at technically had access to my credit card and could steal money.  While you are at work, someone could break into your house and steal your stuff too. The point is, Mint and everything else is a matter of the evaluating the risk.  Since you already understand the vulnerability (they have your accounts) and you know the risk (they could steal your money) what are the chances it happens? 1.)  Mint will make lots more money if it doesn't happen, so it benefits Intuit to pay their employees well and put in safeguards to prevent theft.  Mint.com is on your side even if a specific employee isn't. 2.)  You have statements and such, so you can independently evaluate mint.  I do not just trust mint with my stuff, I check info in Quicken and at the bank sites themselves.  I don't do them all equally, but I will catch problems. 3.)  Laws mean that if theft happens, you will have the opportunity to be made whole. If you are worried about theft, don't trust other people or generally get a bad feeling, don't do it.  If you check your accounts online with the same computer you log into Facebook with, them I would suggest it doesn't bother you.  You might have legal or business reasons to be more adverse to risk then me. However, just because somebody could steal your money, I personally don't consider it an acceptable risk compared to the reward. I will also be one of the first people to be robbed, I am not unrealistic. Although it is strange, there is little risk. The first four numbers are just the card type (Visa, Master, etc.), and the last four alone don't give them much - there are still 8 digits missing that they do not have. There is nothing much they can do with that info, especially without the PIN and the CCV, so as I said, little risk. Maybe they are using this to verify that you are the right person - you probably used that card originally to put money in for the gaming. That would be a way for them to authenticate you. My view is from the Netherlands, a EU country. Con: Credit cards are more risky. If someone finds your card, they can use it for online purchases without knowing any PIN, just by entering the card number, expiration date, and security code on the back. Worse, sometimes that information is stored in databases, and those get stolen by hackers! Also, you can have agreed to do periodic payments on some website and forgot about them, stopped using the service, and be surprised about the charge later. Debit cards usually need some kind of device that requires your PIN to do online payments (the ones I have in the Netherlands do, anyway), and automated periodic payments are authorized at your bank where you can get an overview of the currently active ones. Con: Banks get a percentage of each credit card payment. Unlike debit cards where companies usually pay a tiny fixed fee for each transaction (of, say, half a cent), credit card payments usually cost them a percentage and it comes to much more, a significant part of the profit margin. I feel this is just wrong. Con: automatic monthly payment can come at an unexpected moment With debit cards, the amount is withdrawn immediately and if the money isn't there, you get an error message allowing you to pay some other way (credit card after all, other bank account, cash, etc). When a recent monthly payment from my credit card was due to be charged from my bank account recently, someone else had been paid from it earlier that day and the money wasn't there. So I had to pay interest, on something I bought weeks ago... Pro: Credit cards apparently have some kind of insurance. I've never used this and don't know how it works, but apparently you can get your money back easily after fraudulent charges. Pro: Credit cards can be more easily used internationally for online purchases I don't know how it is with Visa or MC-issued debit cards, but many US sites accept only cards that have number/expiration date/security code and thus my normal bank account debit card isn't useable. Conclusion: definitely have one, but only use it when absolutely necessary. There generally isn't much in the way of real identity verification, at least in the US and online.  The protection you get is that with most credit cards you can report your card stolen (within some amount of time) and the fraudulent charges dropped. The merchant is the one that usually ends up paying for it if it gets charged back so it's usually in the merchant's best interest to do verification.  However the cost of doing so (inconvenience to the customer, or if it's an impulse buy, giving them more time to change their mind, etc) is often greater than the occasional fraudulent charge so they usually don't do too much about it unless they're in a business where it's a frequent problem. "One option might be to set up a separate bank account and a separate credit card account, which you would use only for your ebay transactions.  I have a friend who does a lot of selling on ebay, and this is exactly what she did.   It's reasonable to want to protect your personal finances from any complications that might arise with PayPal and/or ebay.  But since you definitely have to provide a bank account and c.c. number (there's no way around this), the best solution might be to set up separate ""ebay-only"" accounts.  And be sure not to link them to any of your personal accounts, for added protection. If you're planning to do a lot of selling, this is probably a good idea anyway just for record-keeping purposes. If you do a lot of selling on ebay, you might consider setting up a ""merchant account"". There are some limitations on international transactions (currently you can't sell to residents of UK, Australia, or France), and payment processing is a few days slower. But there seem to be fewer fees/risks/etc associated with a  merchant account. I don't know much more about it, but here's an article from an ebay seller, including pros and cons of PayPal vs. merchant accounts. http://www.ebay.com/gds/Selling-on-eBay-without-PayPal/10000000021351301/g.html" Its on their servers which means its accessible via the internet.  And why are you concern about police license plate vacuums?  You afraid they are going to clean your plate?  And why are you more afraid of the DMV getting hacked?  If the DMV gets hacked they won't have access to your credit card info at best social security number. I got a credit card as a student with no income, not even a part time job. They called me, I agreed to one thing and they did another and now I have an old credit history. They don't do this anymore. But technically, student loan debt is unsecured? Have you considered a service that allows you to generate credit card numbers on the fly? DoNotTrackMe allows you to generate a CC number on the fly, for a specific amount.  If the vendor tries to charge more, it will fail.  If it gets stolen, it's useless. I don't know the specific fees off hand, but they have an annual fee for the feature.  Still, for the protection, doesn't seem like a bad way to go. Note: I have no affiliation with DNTM, I'm just a very happy user of their email protection products.  The Masked Cards faq is here. "I have some experience with this.  I have had fraudulent charges appear on my credit card statement and had to change my card number several times, despite (I believe) no carelessness on my part.  Every time that this has happened, I have never lost a penny due to fraud on my credit card.  The bank has ultimately removed the fraudulent charges in every instance. Given this, you'd think the consumer doesn't need to worry about this at all.  But it seems like credit card companies beg to differ. Yes, because although I have never lost a penny to fraud, the bank (or the merchant) loses money every time it happens.  The $0 liability protects you; the card security measures protect the bank. But... why should a consumer ever bother worrying about these in the first place, when he knows he legally can't be held responsible for fraudulent charges? What exactly is this new ""peace of mind"" that he supposedly gets by (say) using features like virtual account numbers that he doesn't already have? Although you shouldn't end up out any money when this happens, it is an inconvenience.  The bank will cancel your card and issue you a new number.  It may take a few days for you to receive your new card.  If you have another card to use, this isn't a big deal.  If you are out of state the day before you need to check out of a hotel and return a rental car with no backup credit card (as I have been), it is a big deal.  (In my case, I had to have the credit card company talk to the hotel to give them the new card number, and they were able to overnight me a new credit card so I could get home.  I now make sure I carry a backup credit card.) Should a consumer put any effort into worrying about this at all? (Why?) In my opinion, it makes sense to be careful what you do with your credit card number, if only to avoid the inconvenience.  Don't type your credit card number into an e-mail message, for example, and only use it on websites that you trust.  That having been said, it is not worth it to be paranoid about it, either.  No matter how careful you are, eventually you will probably use it at a store that gets hacked, or your card will get skimmed somewhere, and you'll need to get a new credit card number. The best way to protect yourself is to make sure that you go over your credit card statement each month and look for any fraudulent charges that the bank didn't catch." The sting here is definitely in the tail, the PS that says We are starting to call you from the same day when we get your details. The initial email doesn't ask for details, it asks for commitment. Once committed, you will be more relaxed about providing details. This makes me think that this is more serious than a simple financial scam. This is an effort to steal your identity, and that could be much more serious than the one-off loss of a few thousand dollars. Here's why: 1. The scammer could get numerous credit cards and store cards in your name, run up thousands or even hundreds of thousands of dollars in charges, and leave you stuck with explaining what happened. I know someone who went from being a multi-millionaire to a pauper in a few months when his identity was stolen - and he is no fool. 2. It will take you years to clear your name. Meanwhile, your credit is shot, and you might have trouble getting a job, renting an apartment, or simply getting a cellphone contract. 3. Once you've repaired your credit, the scammer can just go through his old files and do it all over again. 4. Cloaked in your identity, and therefore being seen as you, the scammer can pull any number of scams, for which you will eventually be blamed. Then as well as dealing with credit bureaus, you will be dealing with another, more serious bureau: the FBI. I think that a prepaid card would have more risk for loss than a traditional credit card.  I've had a various credit cards for about the last 20 years. In all that time, I haven't lost a penny due to fraud. Of course, I've had some fraudulent charges show up, I've had merchants charge too much, and I've had my card number stolen. In every case, my bank has been able to undo any damage and issue me a new card number, if necessary. I really don't spend any time worrying about credit card security, other than checking my statement each month. Security is the bank's problem, not mine.  Prepaid cards are often anonymous. If you are using an anonymous card, how can the bank verify that you are the owner of the card and that you did not make a certain charge? I think, with this type of card, you are very much at risk for losing whatever you have loaded on the card to fraudulent charges. To boil down what mgkrebbs said: Yes, you should send back the form, provided that it doesn't ask for any more information than address, current telephone number, and email address.  Don't ever, ever provide any bank account information. Nor social security number unless you're absolutely positive of the validity of the requestor. Phishing via regular mail is very rare.  It's way expensive compared to email, which is basically free, plus the U.S. Postal Service takes mail fraud fairly seriously (and has the legal statutes to prosecute).   So: don't obsess; send the form back. "These are services that facilitate using credit cards. So whatever vulnerabilities there may be, your risk is limited to your liability to the credit card issuer. Usually, this means no liability whatsoever, and the most significant risk is the inconvenience of re-issuing the compromised card. Some card issuers separate the ""Pay"" service account from your main account so that even that risk is mitigated - the number exposed is only used for that specific service and doesn't compromise your actual physical card." Canadians can email or text each other money through Interac. It is fast - the longest it's ever taken for me is 20 minutes, often it's less - and secure. You don't need to know each other's banking details or even real names. I've used this to send money to my children, each of whom uses a different bank than I do, and they've used it to send money to friends to pay for concert tickets and the like. You add a security question so if someone else got to the email or text first, they wouldn't get the money. I also get an email once the transfer has gone through, so I know they got it. Some banks limit this to $1000 a day, mine to $3000. Typically there is no fee for the recipient and $1 or $2 for the sender. A dollar on $1000 is way better than a 2 or 3% cc processing fee. But even for $30, a dollar is like 3% and you didn't need to apply for anything or set anything up, and your customers don't need a credit card or to trust you with their credit card details. I keep meeting people who don't know about this. Everyone with a Canadian bank account and an email address or smartphone should know about it.