Card numbers on paper order forms: the risk in your desk drawer

Open the bottom drawer of an old order desk and imagine finding carbon copies with full card numbers, expiry dates, and verification codes. Someone kept them to “run the balance” when the sofa arrived. The sale needed a later payment; the drawer became a card-data store.

Move that later collection into the supported payment process. Let the customer pay through a checkout link or the register, and handle existing paper records through a controlled cleanup. A furniture order needs the agreed specification and payment history, not a second copy of the customer's card.

General information, not compliance advice; ask your processor about the store's obligations.

Paper card records are still card records

PCI DSS applies when a full card account number is stored, processed, or transmitted on any medium, including paper. The PCI Security Standards Council answers that point directly in its paper-records FAQ.

A locked drawer can restrict access, but it does not make the collection necessary or remove the obligations attached to it. Copies in a showroom folder, a salesperson's notebook, and a scan on a shared drive also create separate places to control.

Do not assume the issue belongs only to the website. Include phone-order habits, delivery paperwork, and handwritten balance instructions in the review. The showroom PCI guide covers the broader responsibilities.

Never keep the verification code for a later charge

The PCI SSC's verification-code guidance says those codes cannot be retained after authorization, even encrypted. Customer permission does not create an exception. A handwritten code kept for the balance is still retained sensitive authentication data.

A legitimate card-on-file arrangement uses the provider's supported process and the required customer consent. It does not mean staff copy the card and code onto the order form. Ask the provider which tools support the intended later payment.

The PCI SSC also confirms that the future-dated v4 requirements became effective on March 31, 2025. The practical task here remains narrow: stop creating card-data records the furniture workflow does not need.

Give old forms a controlled cleanup

Restrict access while a responsible manager identifies where the records exist. Include carbon copies, photocopies, shared folders, message attachments, and personal notebooks. Do not scan the paper into a shared drive to make the drawer look tidier.

Agree the secure disposal and document-preservation process with the processor and the store's responsible adviser. Use an approved destruction service or suitable secure shredding process for paper, and an appropriate deletion process for electronic copies. Preserve necessary order and agreement information through that approved process without carrying prohibited card data forward.

If a folder is missing or access appears suspicious, follow the store's incident procedure promptly. Do not treat a suspected exposure as an ordinary housekeeping job. The customer-data privacy guide explains why incident obligations need their own review.

Respond to emailed card details without repeating them

A customer may send card details even when the store didn't ask. Do not forward the message to another associate or quote it back in a reply.

PCI SSC's unintended-channel guidance says to minimize further exposure and either remove the data securely or bring the channel under the necessary controls. For a showroom using checkout links, direct the customer to that secure route and have the responsible person handle the original message and copies.

Give staff a prepared response that omits the sensitive information: “Please use this payment link to complete the payment. We don't accept card details by email.” The customer receives a useful next action without the store spreading the data further.

Keep the payment route with the order in OrderPilot

OrderPilot can send a payment link so the customer enters card details in Shopify checkout. Admin deposit orders work on any Shopify plan before placement when enabled; POS Take Deposit uses the native Plus deposit flow. Choose the deposit route the store supports.

The Payments panel keeps payment amounts and history against the furniture order. Staff can explain what was paid and what remains without putting a full card number or verification code in the record.

Use Staff & roles to limit access to customer records and payment actions. Keep notes for the specification and useful sale context. Walnut and smoked oak already require enough careful labeling. The paper-versus-digital quote guide shows how to preserve those details clearly.

Keep the store's own responsibilities visible

Using Shopify Payments does not automatically make every store practice PCI compliant. The PCI SSC's outsourcing FAQ explains that outsourcing can reduce the requirements directly affecting a merchant's environment while leaving responsibilities with the merchant.

Put this short rule in staff training:

• Use the approved checkout, card reader, or provider-managed saved-payment process.
• Never write card numbers or codes in order notes, forms, or messages.
• Never retain verification codes after authorization.
• Escalate unsolicited card data without forwarding it.
• Report missing records or suspected exposure immediately.

Use the store's remaining PCI responsibilities to assign the cleanup and training. The approved payment route should be the one every associate knows how to use.

Sources

1. FAQ 1069: PCI DSS and paper cardholder data — PCI Security Standards Council.
2. FAQ 1280: verification codes and card-on-file transactions — PCI Security Standards Council.
3. FAQ 1157: card data received through an unintended channel — PCI Security Standards Council.
4. FAQ 1092: outsourced payment processing — PCI Security Standards Council.
5. Just published: PCI DSS v4.0.1 — PCI Security Standards Council; confirms the March 31, 2025 effective date.