I recently attempted to place a small order (just over $100) with TrainWorld. Because we live in Australia, the TrainWorld operator insisted on a written order - she would not take a phone order. She suggested I eMail or FAX my details, including credit card info. Those details would then be entered into TrainWorld’s computer system, and we’d go from there.
I sent TrainWorld an eMail with my address and the order details. I pointed out that sending credit card information via eMail is bad practice, and offered to phone with my credit card information when the order was confirmed. Shortly after, I received a thank-you eMail in reply, together with an order number and a recommendation about shipping.
Sounded good - but then I called to provide my credit card info. I was told (by a different lady) that I would have to eMail or FAX an image of my credit card to TrainWorld before they’d do business with me.
There are a few things to note:
-
I’ve recently spent several thousand dollars on G scale equipment from US suppliers (e.g., RLD Hobbies, Charles Ro, Wholesale Trains). In one case (a large order from RLD), I paid by wire transfer, in the other two by credit card. In no case was I asked to do what TrainWorld required.
-
Although we live abroad, I’m an American citizen with a US bank account. I offered to pay for the order either by wire transfer or by personal check from my US account. TrainWorld refused.
-
Advising customers to FAX credit card info is reasonable. Advising them to eMail it is not. All the folks on the network I’m responsible for (20+ servers, around 430 workstations, just over a thousand users) have been advised about the security implications of using eMail. To put it bluntly, there is no security.
-
The risk involved here is like the jar with a million jellybeans. 999,999 of them are delicious. One is filled with deadly poison. Would you eat a jellybean from that jar?
Measure your risk. Use eMail for credit card numbers, CVCs, passwords, PINs, etc. if you have no other choice. If you don’t have to, don’t do it. With TrainWorld, since it’s about buying toys, I cancelled the order. If it was something important and urgent, I’d likely take the chance, despite the fact that I have personal experience of the consequences.
Could I have FAXed TrainWorld the info they wanted? Sure! There’s a 56k modem on my desk. It’s just a matter of disconnecting our ADSL router, powering up the modem, re-booting the PC and sending a FAX off through MS Word. Anyone else at home who wanted to use our little LAN would have been inconvenienced, but only for a half-hour or so. Alternatively, I could have FAXed the info from the post office for a few bucks.
Fact is, I’d rather deal with a supplier where I don’t have the hassle. In my limited experience buying G scale trains from the US, that’s everybody but TrainWorld.