How Should a Small Business Handle Customer Card Numbers Safely?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Don’t write down, email, text, or save full card numbers anywhere in your business. Let your payment processor collect and store card details, and keep only what it shows you, like the last four digits. The card industry’s rules say the security code on the back of the card must never be stored after a payment is approved.

What this means

10.7.6 Payment security

Your payment processor is the company that runs card payments for you. Good processors give you a secure checkout page, a card reader, or a pay link. The card number goes straight to them and never sits in your files.

The card industry has a security standard called the Payment Card Industry Data Security Standard (PCI DSS). Every business that takes cards is expected to follow it. Your processor usually tells you what you need to do, and for many small businesses it starts with a short yearly questionnaire.

11.6.3 Payment information

This line is simple: no card numbers in notes, email, spreadsheets, text messages, your customer relationship management (CRM) system, or any tool your processor didn’t give you for that purpose.

Made-up example: Clearwater Pool Service used to take card numbers over the phone and write them on a job sheet. Now the office sends a pay link from the processor. If a customer reads a card number aloud, the office types it straight into the processor’s secure screen and writes nothing down. Recurring customers are saved in the processor as “card on file,” which shows only the last four digits.

Why it matters

Stolen card data hurts your customers first. Then it hurts you through chargebacks, fines from your processor, and lost trust.
The FTC is blunt about email. Its business guide says “Regular email is not a secure method for sending sensitive data.”
Old data is a hidden risk. A card number in a 3-year-old email is still a card number.
Your processor can drop you. Processor agreements usually require you to follow card security rules.
State breach laws may apply. A leak can trigger notice duties to customers (see 11.6.6 Breach Notification).

Who this applies to

Every business that accepts credit or debit cards, and anyone who handles bank account numbers for customer payments. If you only take cash, you can skip most of this, but the same habits protect any bank details customers give you.

How to do it

Map where payment details could land. Phone notes, email, text, forms, CRM fields, paper job sheets (see 11.5 Data Map).
Move all card entry into the processor’s tools: card reader, pay link, secure invoice, or the processor’s virtual terminal.
Use the processor’s “card on file” feature for repeat customers instead of keeping numbers yourself.
Never store the 3 or 4 digit security code. The PCI Security Standards Council says it can’t be kept after authorization, even encrypted.
Turn off any website form field that asks for a card number unless it’s part of your processor’s secure checkout.
Write a one-paragraph rule for staff: how to take a card payment, and what to do if a customer emails a card number (delete it, empty the trash, and reply with a pay link).
Search your old email, files, and CRM for card numbers and delete them securely (see 9.8.5 Secure Record Destruction).
Protect the accounts that control payments. Use strong passwords and multi-factor authentication on the processor and bank logins (see 11.7.3 Multi-Factor Authentication).
Finish the PCI questionnaire your processor asks for, and save the confirmation.

What proof to keep

Your written payment security rule, with the date staff read it
Your processor’s PCI questionnaire or compliance confirmation
A note of the date you searched for and deleted old card numbers
A screenshot showing saved cards are masked in the processor

Store these in your security or financial records folder.

Common mistakes

“I’ll just hold the card number until the job is done.” Use the processor’s authorization or card on file feature instead.
Card numbers in a CRM notes field. It’s searchable and gets exported. That’s exactly where they shouldn’t be.
Screenshots of cards sent by text. Ask customers not to send these, and delete any you receive.
Shared logins to the processor. You can’t tell who refunded what.
Thinking encryption makes the security code OK to keep. It doesn’t.

When to get help from a pro

Your payment processor’s support team can tell you which PCI questionnaire applies and how to use its secure tools. An IT or security specialist can help you search your systems for stored card data. Questions to ask:

Which PCI questionnaire do I need to complete, and how often?
Can your system store cards for repeat billing so I never see the full number?
How do I find and remove card numbers already in my email and files?

Bill’s note

[Bill: add a short note. For example, how often you’ve seen small businesses keep card numbers in email or spreadsheets, or how SiteSmarty takes payments without ever handling card numbers.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: how SiteSmarty collects card payments and where card data lives]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: processor screen showing a masked saved card]
[Result so far:]

Questions people ask

Can I write down a customer’s card number? No. Type it directly into your processor’s secure screen and don’t keep a copy.

Can I keep the security code for repeat charges? No. The card industry’s rules don’t allow storing it after authorization. Use your processor’s card on file feature.

A customer emailed me their card number. What do I do? Enter the payment through your processor if they asked you to charge it, delete the email from your inbox and trash, and send them a secure pay link next time.

What is PCI compliance? It means following the card industry’s security standard. For most small businesses, it means using approved payment tools, not storing card data, and filling out a yearly questionnaire from your processor.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
10.7.6 Payment security	Are all card payments taken through the processor’s secure tools, with a current PCI confirmation?	Card reader, pay links, or secure invoices only. PCI questionnaire done this year.	Card numbers taken on paper or by email. No PCI confirmation.	Processor settings, PCI confirmation, written payment rule
11.6.3 Payment information	Are there zero full card numbers in notes, email, spreadsheets, texts, or the CRM?	A search finds none. Saved cards appear masked in the processor only.	Card numbers in CRM notes, inboxes, or job sheets.	Dated search results and deletion note

Where this fits

Do this first: 10.7.1 Payment Methods, 10.7.5 Invoices

Do this next: 10.7.7 Chargebacks

Sources

PCI Security Standards Council, "PCI Data Storage Do's and Don'ts" (checked October 17, 2026)
FTC, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.