I don't think "user2" is claiming that the credit card information was sent in plaintext: normally you ATLEAST enccrypt the securtity code, even if its ssl Th

I don't think "user2" is claiming that the credit card information was sent in plaintext: normally you ATLEAST enccrypt the securtity code, even if its ssl That seems to refer to encrypting the CC security code before sending it over SSL using public key encryption, which is good practice if you subscribe to defence in depth. But it's nothing I'd get upset about.