TechKnowledge blog

Emailing Credit Card Forms is a Risk to Your Business

TechKnowledge — Mon, 10 Aug 2026 15:05:53 GMT

Emailing Credit Card Forms isn’t “simple”; it’s a Risk with Big Consequences

You send a form. The customer fills out their credit card number, expiration date, billing ZIP, even the security code on the back. Then they’re told: “Just scan it and email it back.”

So many businesses still do this. It feels harmless. It feels old-school. It feels easier than setting up a payment portal!

But there’s a major security risk: When that form is emailed, your inbox is a storage location for credit card data. So is your laptop or maybe even an employee’s laptop, phone, or a random Downloads folder. Possibly a printer, scanner, or cloud backup. It’s not nefarious, just the nature of workflows…

But it also is NOT a process. It’s a data security problem and it creates serious compliance issues with the Payment Card Industry Data Security Standards (PCI DSS).

PCI DSS applies to organizations that store, process, or transmit cardholder data, and the financial institutions (think Visa/Mastercard) will levy heavy fines and penalties against businesses who break these regulations. https://usa.visa.com/dam/VCOM/download/about-visa/visa-rules-public.pdf

And, while the fines will hurt financially, penalties can include major rate increases, suspensions, or even termination. That means no more processing credit cards, and that can mean lights out.

Paper Doesn’t Make It Safe

Some owners assume paper is somehow outside cybersecurity. It isn’t.

The PCI Security Standards Council specifically says PCI DSS applies when a Primary Account Number, or PAN, is stored, processed, or transmitted “on or by any media,” including paper records. It also notes that PCI DSS Requirement 9 addresses safeguarding physical media, including paper records containing cardholder data. (PCI Security Standards Council)

A paper credit card form is a record containing payment card data. If it sits on a desk, gets tossed into an unlocked drawer, is scanned to email, printed, downloaded, or saved in a folder called “Customer Forms,” it’s part of your cardholder data environment.

And now you now have to answer harder questions:

Who can access it?
Where is it stored?
How long is it kept?
Is it encrypted?
Can employees forward it?
Is it backed up?
Was it deleted securely?
Was the CVV stored after the transaction?
Could someone steal it from email, paper files, or a shared drive?

Most businesses owners won’t have good answers to those questions.

Email Is the Real Problem

Email was not built to be your payment vault.

The PCI Security Standards Council is direct on this: unencrypted PANs cannot be sent over email, instant messaging, SMS, or chat. PCI DSS Requirement 4.2.2 prohibits sending unprotected primary account numbers through end-user messaging technologies, and PCI DSS Requirement 4.2.1 requires strong cryptography and security protocols when cardholder data is sent over open, public networks. (PCI Security Standards Council)

There’s an important nuance here. PCI DSS does not say a business can never request cardholder data through email or other messaging tools. But if a business uses that channel to receive or send PAN, then that channel has to be protected under applicable PCI DSS requirements, and related systems, such as email servers, can come into PCI scope. (PCI Security Standards Council)

That’s where small businesses get trapped. They think they’re using a simple shortcut. In reality, they may be expanding their compliance footprint from “we use a payment processor” to “our email, employee laptops, phones, scanners, file storage, backups, and retention practices may all be involved in handling credit card data.”

That’s a very different world.

The Security Code Is Even More Dangerous

The CVV or CVC code — the three or four digits on the card — deserves special attention.

PCI DSS does not prohibit collecting that code before authorization for a specific transaction. But once the transaction is authorized, the code cannot be retained. PCI SSC is clear that storing card verification codes after authorization is prohibited, even if the customer gave permission. (PCI Security Standards Council)

So if your paper form asks for the security code, and that form gets emailed, saved, printed, or filed after the payment is run, you may have created a serious compliance issue.

The Data Spreads Fast

The biggest danger with emailed credit card forms is that the data doesn’t stay in one place. It spreads quickly, increases your attack surface, and creates huge liability. Consider this:

A customer emails the form >> Your office manager downloads it >> Someone prints it >> Someone forwards it to billing >> The attachment stays in Gmail or Outlook >> The file syncs to OneDrive, Google Drive, Dropbox, or a local desktop >> The scanner saves a copy >> The email backup keeps another copy >> The paper version sits in a folder >> The trash copy sits in the recycling bin >>>>

Now imagine there’s a breach. You don’t just have to say, “Someone got into our email.” You may have to say, “We had customer credit card information stored in email, attachments, downloads, paper files, and backups, and we’re not sure how long it was there or who accessed it.”

That’s the part most owners don’t see until after something goes wrong.

What Small Businesses Should Do Instead

Stop asking customers to email credit card forms! Use a payment link, hosted payment page, secure invoice, card-on-file feature, or customer portal through a reputable payment processor.

The goal is simple: let the processor collect and protect the card data, not your inbox.

You can still get written authorization from the customer. You can still have terms. You can still document what they agreed to pay. But the actual card number should go through a secure payment workflow — not a PDF, photo, scan, or email attachment.

Also, train your team on what to do when a customer emails card data anyway. PCI SSC says when cardholder data is accidentally received through an unintended insecure channel, the merchant should either bring that channel into the cardholder data environment and secure it, or implement measures to prevent that channel from being used for cardholder data. It also says the business should avoid further unsecured transmissions, remove or secure the data, and communicate secure payment methods to customers (PCI Security Standards Council), but in plain English:

Don’t reply with the card number still in the thread
Don’t forward it around the office
Don’t save it “just in case"
Don’t print it and leave it on a desk
Don’t keep the CVV after the transaction
Do move the customer to a secure payment method

Convenience Is Not a Security Strategy

Small businesses use paper and email because it feels easy. But easy can get expensive.

A paper credit card form emailed back to your office may create more risk than the owner realizes. It can pull email into PCI scope. It can leave card data scattered across devices and backups. It can expose customers. It can create hard questions after a breach. And if CVV codes are stored after authorization, that’s a problem no small business wants to explain.

The better move isn't complicated:

Use a secure payment link
Use a trusted processor
Keep credit card information out of email
Limit who can access payment information
Destroy old paper records
Train your people

Know your risk. Protect what you’ve built. Convenience should never turn your inbox into a credit card vault, and if we can be a resource to help you get that done just fill out the form below.

Cybersecurity: A Layered Approach

TechKnowledge — Fri, 07 Aug 2026 22:16:26 GMT

Work Follows You Everywhere. Security Should Too. 5 Tips!

TechKnowledge — Wed, 15 Jul 2026 19:53:54 GMT

There’s an understanding most business owners come to terms with early – running a business doesn’t stay at the office, and it’s not Monday – Friday, 9am to 5pm. It follows you into parking lots, kitchens, coffee shops, family events, waiting rooms, or school pickups.

And because work follows you, your security should too.

That doesn’t mean complex and costly. It means basics matter – especially when your phone, email, banking, invoices, client files, and business conversations are all moving with you. With that in mind, here are five practical ways to keep work safe; wherever life takes you:

1. Treat your phone like a business device --> it is one

For most of us, the phone is the office. It has our email, calendar, banking, client texts, files, password reset codes, and authenticator app. It maybe even have access to payroll, QuickBooks, or the company CRM.

That’s not a phone. That’s a front door to your business. So, at minimum:

-Use a strong passcode
-Turn on face or fingerprint unlock
-Keep the phone updated
-Know how to remotely wipe it if it’s lost
-Never let your kids, friends, or employees use it casually

2. Stop trusting email for money decisions.

This is where small businesses get crushed. An invoice comes in. A vendor asks to change banking information. A client says they need payment details updated. Someone asks for a wire, ACH, or gift card purchase. The email looks normal. The tone sounds familiar. The timing makes sense.

That’s exactly why it works. Attackers don’t need to hack the bank if they can hack the conversation.

Company policy should be that any request involving money, banking changes, payment instructions, payroll changes, or sensitive client information gets verified outside of email.

- Call a known number
- Use a client portal
- Confirm in person
- Use a second channel you already trust

Don’t reply to the suspicious email and ask, “Is this really you?” If the inbox is compromised, you may be asking the criminal.

3. Stop reusing passwords. Not for work. Not for personal. Not anywhere.

As we wrote about in our blog on how creds get stolen, password reuse is one of those boring cybersecurity topics that becomes very exciting when something goes wrong

Here’s the problem: if you use the same password for your kid’s school portal, your personal email, your business email, and your accounting software, one breach can become many breaches.

Criminals know people reuse passwords. They count on it. So use a password manager, or at the least create unique passwords for every important account. Start with the big ones:

-Business email
-Banking
-Accounting software
-Microsoft 365 or Google Workspace
-Payroll
-CRM
-Any system with client data

You don’t need to memorize everything. You need a system that keeps you from using the same password everywhere.

4. Use MFA, but don’t approve every prompt.

Multi-factor authentication is a simple and critical layer of protection, and we highly recommend turning it on wherever possible.

But here’s the catch: MFA only works if the human using it slows down.

If you get a login approval prompt and you weren’t trying to log in, don’t approve it. It could be that someone has your password and is trying to get through.

This happens more than people think. Someone clicks a fake Microsoft login page. The attacker captures the password. Then the attacker immediately tries to log in. The real user gets an MFA prompt and hits “Approve” out of habit.

That one tap can open the business. So make this one rule clear for yourself and your team --> No unexpected login prompt gets approved. Ever.

5. Give yourself permission to slow down.

Business owners move fast because they have to. We’re answering clients, managing employees, checking invoices, handling family logistics, putting out fires, and trying to keep the business moving. The pressure is real.

But speed is exactly what attackers exploit. They want urgency. They want distraction. They want you walking across the street, half-looking at your phone, trying to solve three problems at once.

So give yourself permission to slow down. It’ll be the cheapest security tool you ever use!

- Before sending money, pause.
- Before opening the attachment, pause.
- Before approving the MFA request, pause.
- Before sharing client information, pause.
- Before clicking the link, pause.

And if you have employees, say it out loud. Put it in the handbook. Repeat it during onboarding. Bring it up in weekly meetings.

It’s okay to slow down when something feels off. Actually, it’s expected.

Security Has to Fit Real Life

The goal here isn’t to scare anyone. It’s to be honest about how work actually happens. Business doesn’t live in one building. It lives on phones, laptops, home Wi-Fi, coffee shop networks, shared files, email threads, text messages, and cloud apps.

That’s especially true for small business owners.

You’re not just running a company. You’re living a life while running a company. So start with the basics:

1. Protect the phone
2. Verify money requests
3. Stop reusing passwords
4. Use MFA
5. Go Slow

Know your risk. Protect what you've built. If work follows you everywhere then security should too. If we can help you further explore this topic or other ways to stay safe just complete the form.

Let Your People Know – It’s ok to go slow

TechKnowledge — Wed, 15 Jul 2026 19:53:44 GMT

With limited time, resources, and a list of things to worry about, small businesses are on the menu for today’s criminal looking for an easy mark. Attackers know that owners are busy, stretched thin, and often operating without the same security structure larger companies take for granted.

Is it possible for a small business to stay safe without breaking the budget?

Along with using modern equipment (machines withen five or six years old, on Windows 11 or up-to-date MacOS) and maintaining business grade licensing, most security analysts would agree that User Education is of critical importance, delivers biggest bang for the buck, and is easily the one where most business fail.

After all, users are proven to be the one most exploited! Our people are a major weakness, and for the purposes of this blog we’re going to focus on that, adjust for it, and make it a strength.

In cybersecurity, one of the best ways to become “faster” is to slow down. Cybercriminals bet on our speed. They create urgency and apply pressure. It’s why the most important things a business owner can do is give their permission to slow down.

Permission to pause when something involves money, passwords, client information, payroll, banking, access to business systems, or when something just doesn’t seem right. And that permission shouldn’t just be implied. It should be in the handbook, stated during onboarding, repeated in weekly meetings, and effectively made part business operations.

It should be ingrained into the culture: “When money, passwords, banking information, client data, payroll, or access to our systems is involved, slow down, verify, and ask if your uncertain.”

That one sentence can change the culture. It tells people that asking questions is not a problem. It tells them that confirming a request is not an inconvenience. It tells them that security is part of the job, not something separate from the job.

If we recognize that “we the people” are often the biggest risk, we can address that risk. We can talk about it. We can train around it. We can build better habits. And over time, we can turn the culture of the organization into one of its greatest strengths.

Being secure online is a choice. It’s not always complicated, but it does require attention. You can protect your data, avoid common cyberattacks, and operate in a more secure environment by getting the basics right and treat cybersecurity as a people issue, not just a technical one.

Yes, tools matter. Security software matters. Multi-factor authentication matters. Proper Microsoft 365 licensing matters. Updated computers matter. But none of that replaces a team that knows how to slow down, think twice, and ask the right question before clicking, sending, approving, or sharing.

So here are 5 things we suggest

1. Your attitude and work habits send a message

If the always rushing, always demanding immediate action, and always making people feel like speed matters and accuracy is expected, employees will move fast and mistakes will be made.

That's not to say you need to change your workstyle. We're not business coaches. But the message needs to be clear: “When something involves money, client information, passwords, banking, payroll, or access to our systems, I want you to slow down. Slow down and verify.”

That should be repeated often. Put it in your employee handbook. Say it during onboarding. Bring it up during staff meetings. Remind people before busy seasons, tax deadlines, billing cycles, payroll runs, travel periods, or any time the business is moving fast. Send them educational information like our blog on how passwords are compromised so they understand the issue is real.

Criminals are no longer attacking your technology. They’re attacking your process and your people.

2. Verify before sending money or information

This is one of the simplest and most important habits a small business can build. We wrote about it in our blog on how security should follow you just like work does. Before sending money, changing banking information, sharing client data, approving a wire, or responding to an unusual request, verify it through another channel.

Not by replying to the same email. By picking up the phone, sending a new text, or even calling the number you already have on file.

If a vendor emails new payment instructions, verify.
If a client asks you to send sensitive documents to a new email address, verify.
If someone inside the company asks for gift cards, banking changes, payroll updates, passwords, or urgent payments, verify.

3. Talk about the risks with your team

Most people don’t make security mistakes because they’re reckless. They make mistakes because they don’t know what to look for.

So talk about it. Talk about fake Microsoft login pages. Talk about invoice scams. Talk about wire fraud. Talk about text messages that look like they came from the owner. Talk about emails that create urgency, fear, or pressure.

Make cybersecurity part of normal business conversation. You don’t need to scare people. You need to make them aware.

4. Be skeptical of urgency

Cybercriminals love pressure. They want your people moving fast. They want them nervous. They want them worried about missing a deadline, upsetting the boss, losing a deal, or creating a problem.

That’s why so many scams sound urgent:

“Please handle this right away.”
“I need this before the end of the day.”
“Your password is expiring.”

The more urgent something feels, the more important it is to slow down. Healthy skepticism is not paranoia. It’s good business.

Teach your team that it’s okay to pause. It’s okay to ask questions. It’s okay to confirm. It’s okay to say, “This doesn’t feel right.” That one sentence can save your business a lot of pain.

That’s a fair question for your IT provider. And if you don’t have an IT provider, it’s a fair reason to get a review.

5. Make security part of the culture

The goal is not perfection. The goal is awareness.

A secure culture is one where people pay attention. They verify before acting. They use strong passwords. They report suspicious emails. They don’t hide mistakes. They know that protecting the business is part of everyone’s job.

That doesn't require a cybersecurity degree. It requires leadership. A small business owner can set the tone by saying: “We take this seriously”, or “If something feels wrong, say something.”

That’s training. That’s culture. That matters.

It's about being constant and consistent

Of course, this list is not comprehensive. There are many other ways to increase your speed, reduce your risk, and make your business a harder target.

Security tools and software are important, and in many cases, highly recommended. But the most basic and powerful place to start is with your people.

Talk to them constantly and consistently and let the know that they have permission to slow down.

Know your risk. Protect what you've built. We find employees learn best when they’re told by someone other than you. If we can help in that regard, complete the form below and let’s setup a quick training.

How Credentials Get Stolen

TechKnowledge — Tue, 14 Jul 2026 19:50:49 GMT

How do Credentials Get Stolen? It’s easier than you may think.

Most small business owners don’t realize the level of sophistication, research, and social engineering that goes into a modern cyberattack, especially when it comes to stealing credentials (user ID and passwords).

Today’s phishing attacks look clean, make sense, feel normal, and many are successful. Criminals research our behaviors; they know who we are and how we’ll react. Their messaging is deliberately timed and designed to get us moving quickly, get us flustered, or even lull us into a false sense of security so that we stop thinking, react and execute.

Think your credentials are secure? Run a secure scan at www.HaveIBeenPwned.com and find out.

In the meantime, here are three sample attacks designed and socially engineered specifically to hit the small business. Would you have been compromised?

1. The Shared File That Needs Review

You get an email from an already compromised client. You believe the email address to be real, not realizing the client was breached on a prior attack a few weeks ago, and the hacker was able to create a fake email in their corporate domain.

The message explains that there's a shared document, and refers to an update in their payment processing. It doesn’t feel random. It feels like business, like something you need to look at. So you click through what appears to be a secure link and the document almost opens, but there’s an issue. You X out and try again. Same thing. You try once more, and this time you’re prompted for your Microsoft login.

“This is so aggravating,” you think. But you enter your credentials and approve the MFA prompt.

From your side, the document opens and nothing seems strange. It’s actually a pretty straight forward document on confirming payments by email.

But the attacker has what they need. The credentials you provided gives the attacker access to your email account, and all the conversations and information flowing through your business.

2. IT Is Here to Fix the Problem

You and a few employees have been getting blitzed with suspicious emails for weeks. It’s annoying. You’re tired of hearing about it. But everyone knows the routine: don’t click, delete, move on.

Then, one random Thursday evening, you’re enjoying a bit of down time and maybe a nice drink when your phone rings. It registers Microsoft.

You answer, and a kind support person explains they’re calling about the email attack your business has been experiencing. Good news — they can help end the madness!

They just need to send you a secure Microsoft link so you can verify your account and update your security settings.

The email arrives while they’re on the phone and they talk you through it – click, enter your credentials, approve the MFA, and you just handed over the keys to your business.

The fake emails were the setup. The phone call was the close and the timing of the close was no accident. It’s quiet time for you, and these criminals know businesses owners hate quiet time. This is your chance to knock something off your list, while enjoying a drink and be the hero…. careful!

Remember, just like your work, security should follow you everywhere!

3. The Vendor Password Reset That Wasn’t

Your employee gets an email from a vendor.

Maybe it’s your payroll company. Maybe it’s your accounting platform. Maybe it’s an industry-specific system your business uses every week, and again, the message looks real. The logo’s correct. Your company name is there. Their name is there. Maybe even an account number, invoice number, or real support case.

The problem is the vendor doesn’t yet know they’ve had a data issue and an account yielding customer information was exposed. Not a ton of data, enough pieces of the puzzel to make things feel normal. On email, criminals don’t need much.

The message says that due to a recent security update, all users must reset their password by the end of the day to avoid losing access.

The employee’s busy. They need that system. Payroll may be coming up. Invoices may be going out. Whatever the case, the attackers have likely socially engineered the email to your employees weak spot. They know what’s in your staffer’s head and they’re gonna exploit it.

So they click. The page looks legit. They enter their current password and create a new one. Maybe they even get an MFA prompt.

Now the attacker has an old password, a new password, and possibly access to the real system. Also, if that's a reused password, there's no t

So, What Can Be Done?

Simple answer - stop. Take a beat. Don’t ever enter your credentials unless you’re the one who initiated the process. That is the most important thing you can do.

The next is of course letting your people know that it's ok to go slow, as we wrote about in our blog on cybersecurity training. Too many owners assume their people know what to do and will be cautious. We know you hire good people, but that doesn't mean they wont make a mistake.

Know your risk. Protect what you’ve built. There are many security tools and software packages to help end-users in this very hand-to-hand combat style of attack. Some cost more than others and some require more setup and customizations. Do your research, find what works for you, or fill out the form below if we can be a resource.

Summer is the Time

TechKnowledge — Tue, 14 Jul 2026 16:01:42 GMT

Assuming your business isn't summer seasonal, this time of the year is typically slow for most owners. The phone rings less, vendors are harder to reach, employees take long weekends, and hopefully even you’re looking at a few days off!

That can be frustrating when you’re trying to close work, collect money, or get answers from people who are “currently checking email periodically.” But things just don’t seem to move as fast in July and August. If that’s the case for you right now, that may not be a bad thing, assuming you’re able to capitalize on the well-deserved quiet time.

According to this recent article How to Conduct a Mid-Year Business Review by SCORE (a nonprofit organization and resource partner of the U.S. Small Business Administration), “summer is a smart time to make strategic moves while your competitors are taking it easy.”

The summer slowdown gives you an opportunity to take advantage of something most business owners rarely get - a little space. And if IT security has been sitting on your to-do list, this may be a great time to look into a few things. You don’t need to solve every issue. But you can defiantly use the summer slowdown to knock out a few things that materially lower your IT risk before business picks back up.

5 Basics to Tackle During the Summer Slowdown

1. Put that password manager in place

If your team is still saving passwords in browsers, notebooks, spreadsheets, text messages, or “that one document everyone uses,” deploying a company password manager is a quick and inexpensive place to start

Nothing fancy needed, any business-grade password manager works. Set it up for key employees. Move the important accounts first: email, banking, payroll, accounting, website, CRM, payment processing, and anything with customer data. Make a list, and work through it.

2. Turn on Multi-Factor (MFA)

Multi-factor authentication, or MFA, is another simple and affordable security improvement.

At minimum, it should be turned on for email, banking, payroll, accounting, remote access, cloud file storage, and administrator accounts. If someone gets a password, MFA can be the thing that keeps that password from becoming a full-blown incident.

And don’t just turn it on for the team. Make sure the owner’s covered as well.

3. Check your licensing

A lot of small businesses are paying for tools they’re not really using — or using tools that don’t give them the protection they think they have.

Summer is a great time to review your Microsoft 365, Google Workspace, backup, antivirus, email security, accounting, CRM, and file-sharing licenses.

Ask a few basic questions:

- Are we on business-grade licensing?
- Are we paying for security features we haven’t turned on?
- Do former employees still have active accounts?
- Are users sharing logins and do we own enough licenses?
- Are personal email accounts being used for business?

This is not just about saving money. It’s about knowing whether the tools you already have are actually protecting the business.

4. Inventory your equipment

Look under desks, in draws, and of course hit the top shelf of every closet! Make a list of laptops, desktops, tablets, phones, printers, routers, and even external hard drives that contain business information.

For each item, capture the basics: who has it, what it is, serial number if available, approximate age, whether it is still being used, and whether it may contain company or customer data.

This may sound boring, but that's because it is boring. It’s also important! You can’t protect what you don’t know you have. And you definitely can’t retire it properly if it’s sitting in a closet with old client files, tax records, contracts, passwords, or saved browser sessions still on it.

5. Clean out, wipe, and properly dispose of old equipment

Old machines are easy to ignore. They sit in a closet, garage, basement, or back office because nobody wants to deal with them. Now's the time to deal with them!

If a device is no longer needed, wipe it properly before it leaves your control. If it contains sensitive data, customer records, financial information, employee files, medical information, legal documents, tax records, or anything regulated, don’t guess. Use a qualified provider and get a certificate of destruction if your business, industry, insurance policy, or compliance obligations require one.

Staples offers Retail Recycling which can be very useful for the small business owner. But don’t confuse recycling with certified data destruction and if you need proof that data was destroyed, make sure you use a service that provides the right documentation.

The rule is simple: Before technology leaves your business, wipe it clean and make sure you can prove it if you need to. Then update your inventory list above with removal/destruction date.

Overall, The Point Is Progress

None of this is flashy. None of it is crazy expensive. These are the kinds of basic steps that make a small business harder to compromise, easier to manage, and less dependent on memory, guesswork, and good luck.

Password manager. MFA. License review. Equipment inventory. Proper disposal. Put them all in place and you’re not only more secure, you’re also starting to shift the culture and generate an awareness that security is important.

Know your risk. Protect what you've built. You don’t need to spend the summer buried in IT. But if the phone is ringing a little less or the calendar has a little more breathing room, use the time. Get the basics handled now, and fill out the form below if we can be a resource.