Dave,

I do regularly work for a major Irish charity but you can rest assured that that system does not email any credit cards in any form to anyone, and it never has. In fact it never even stores the details of the cards at all, it sends them off over SSL to be processed by a third-party who only send back a transaction ID which is then stored in an encrypted form. You can't really get more secure than that!

There was one site I did MANY years ago that did send encrypted credit card numbers via email (but not the expiry date). I thought it was a bad idea then and I think it's a bad idea now but sometimes you just have to do what the customer asks. It was either store the lot on a shared web-host, email the lot, or split the data so that only half went by either imperfect route. That way if an attacker hacked the site they would get only credit card expiry dates and if they intercepted the emial they would get only encrypted credit card numbers. I did strongly advise that the customer user a service like Realex or Worldpay but the reality was that the site was too low on traffic to make that financially viable.

Hope that clears things up a bit.