PCI Compliance for Law and Accounting Firms: Stop Emailing Card Numbers

On this page 7 sections

1. How Professional Offices Accidentally Store Card Data
2. Which PCI Self-Assessment Questionnaire Your Firm Needs
3. Replacing Paper Authorization Forms With Tokenized Card on File
4. Phone Payments: Keeping Staff From Writing Down Numbers
5. Client Portals and Payment Links That Keep You Out of Scope
6. Breach Liability and Overlap With Client Confidentiality Duties
7. A Two-Week Cleanup Plan for Card Numbers Already in Your Files

Key takeaways

• Keep the client's signed consent to charge a stored card, but never the card number itself. A token from your processor replaces the number.
• How card data reaches your systems decides which PCI questionnaire you file. Hosted pages and links lead to the shortest one.
• If your phone system records calls, any card number read aloud on a recorded call brings those recordings into PCI scope.
• At a law firm, a litigation hold or retention duty can cover documents that contain card numbers. Redact the card data instead of deleting the document, after checking with whoever manages retention.

PCI compliance for law firms and accounting practices depends on one question: does a client's full card number ever land in your email, your files, your notepads or your computers? If it does, your office falls under far more of the Payment Card Industry Data Security Standard (PCI DSS) than a small firm can realistically manage. If clients type their card into a page hosted by your processor and you keep only a token, most of that burden moves to the provider, and your annual compliance paperwork gets much shorter.

The fix costs less than most firms expect. Mostly it means dropping the habits that bring card numbers into the office in the first place.

How Professional Offices Accidentally Store Card Data

Nobody at a law or CPA firm decides to build a card database. It builds up on its own. A client emails a photo of their card with "please charge the retainer." An intake packet has lines for card number, expiration date and security code. A paralegal writes a number on a legal pad while the client reads it over the phone and keys it in after the call. A bookkeeper keeps a spreadsheet of monthly-retainer clients "so we don't have to ask again."

Each of these habits makes copies, and every copy is something that can be breached.

Here is an illustrative trace. Assume a five-person firm that uses hosted email with normal retention settings, scans signed paperwork into its document management system, and backs up both every night. A client emails a completed authorization form:

1. The receptionist receives it, so the card is now in her inbox.
2. She forwards it to billing. Now it is also in billing's inbox and in her sent folder.
3. Billing prints it to charge the card and to sign off on it.
4. The printout gets scanned into the client's matter folder.
5. The paper goes into the physical file.
6. That night, the email server and the document system back up every one of those digital copies.

So one email from one client becomes at least six copies, and the firm can't easily delete some of them. Multiply that by every client who has paid this way over the years. Many of those forms also have a filled-in security-code box. PCI DSS does not allow merchants to keep that code after a payment is authorized, so a file cabinet full of those forms is a problem even if nothing else is.

Which PCI Self-Assessment Questionnaire Your Firm Needs

First, it helps to know what PCI actually is. PCI DSS is a security standard maintained by the PCI Security Standards Council, which the major card networks founded. It is not a federal law. It binds your firm because your merchant agreement requires you to follow card network rules, and the networks require PCI DSS. A small firm usually doesn't hire an outside auditor. Instead, it completes a self-assessment questionnaire, typically through a portal its processor provides, and attests that it complies.

The Council publishes several questionnaires of very different lengths. Which one you file depends on how card data reaches your systems.

Each questionnaire has specific eligibility criteria, so confirm with your processor which one fits before you file. The table shows the direction you want to move in. Every place a card number stops counts against you, and a firm that never receives the number has very little to protect.

Many processors also charge a monthly or annual fee to merchants who don't complete their questionnaire. That fee is a processor's pricing decision, not a card network rule, and the amount varies from one provider to another. Look for a line labeled "PCI non-compliance" or similar on your statement. If you find one, finishing the questionnaire usually makes it go away.

Replacing Paper Authorization Forms With Tokenized Card on File

The law firm credit card authorization form exists for a good reason. You need the client's written permission to charge a stored card later, whether for replenishing a retainer, a monthly bookkeeping fee or court filing costs. That consent is worth keeping. The card number written on the same sheet is the risk.

So split the two. With tokenization, the client enters the card on a page your payment provider hosts. The provider stores the number and gives your account a token, which is a reference code that works only inside your merchant account and is useless to a thief. When you need to charge the client next month, you charge the token. Nobody at your firm ever sees the card number.

Your authorization language should still cover what you will charge, when, how you calculate the amount or what the cap is, how you notify the client before a charge, and how the client can revoke consent. Card networks have rules for stored credentials and merchant-initiated charges that expect this kind of disclosure, so ask your processor for its requirements. For firms that refill trust balances automatically, our guide to evergreen retainers with card on file covers the setup. Our article on engagement letter payment terms shows where the consent language belongs.

Law firms face one more question: which bank account does the token charge pay into? State bar trust-accounting rules affect how card deposits and processing fees can touch a client trust account. Confirm those rules with your bar before you automate anything. Our comparison of LawPay, Clio Payments and Headnote walks through how legal-specific tools handle that split.

Phone Payments: Keeping Staff From Writing Down Numbers

Phone payments are where good policies tend to break down. The client wants to pay right now, and the staff member wants to help.

The best option is to send a payment link while you're still on the call. The client enters the card on their own phone, you see the payment come through, and no one at the firm ever hears the number. If a client can't use a link, staff should enter the card straight into a virtual terminal for keyed payments as the client reads it. Paper, sticky notes and "I'll run it after lunch" should never be part of the process. Use a computer set aside for payments, not the shared reception PC that half the office browses on, and keep staff from repeating the number aloud in an open office.

Check your phone system too. If it records calls for quality or billing, any card number spoken on a recorded call ends up inside those recordings, which pulls the recording system into PCI scope. Either pause recording during payment or move phone payments to links completely.

Keyed cards also cost more. They are processed as card-not-present transactions, which carry higher interchange and more dispute exposure than a tapped or inserted card. Our breakdown of why keyed and online card fees cost more explains the reason. Clients who come into the office can tap a terminal instead.

Client Portals and Payment Links That Keep You Out of Scope

A secure payment link for clients is the cleanest replacement for emailed card numbers. You can put the link on invoices, in engagement-letter emails and in a client portal. Vendor marketing that calls a link "secure" proves nothing, though. Before you adopt any portal or link tool, ask these questions:

• Who hosts the payment page? When the client clicks, the card-entry page should live on the processor's or gateway's domain. If it appears inside your own website, ask exactly how the card data flows.
• Can the provider show its own PCI compliance attestation? A provider that handles card data for you should be able to prove it is validated.
• Does your practice-management or tax software store full card numbers, or does it pass them to a processor and keep only a token?
• What can staff see in the admin screen? Everyone at the firm should see the last four digits and nothing more.
• Who can pay the link? When a relative or employer pays the bill, the link keeps their card out of your inbox too. Our article on third-party card payments for legal bills covers the consent and refund issues.

For firms building their own setup, MannyPay supports online acceptance through payment gateways such as Authorize.net and NMI and integrates with QuickBooks. It also lists payment processing for professional services firms and legal services payment processing among the industries it serves. Whatever provider you use, ask specifically about hosted payment pages and stored-card tokens, and get the answers in writing.

Breach Liability and Overlap With Client Confidentiality Duties

If card data leaks from your office, the payment consequences alone can be serious. Your processor may require a forensic investigation, pass card network assessments on to you, hold back funds or close your account. State breach-notification laws may also require you to notify affected clients. Those laws vary by state.

For professional firms, the bigger issue is that a card-number leak is almost never only a card-number leak. The inbox that holds emailed card photos also holds Social Security numbers, tax returns, settlement drafts and privileged correspondence. Lawyers' conduct rules in most states include a duty to make reasonable efforts to protect client information. Accountants face professional standards, and many tax preparers also have federal data-safeguarding obligations. Removing card numbers from email is part of the same discipline those duties already require. If your firm carries cyber insurance, check whether the application or policy asks about PCI compliance, because a wrong answer there can complicate a claim.

This section is general information, not legal or regulatory advice. Confirm your obligations with your malpractice carrier, your state bar's ethics counsel or a qualified compliance professional.

A Two-Week Cleanup Plan for Card Numbers Already in Your Files

1. List every way a payment reaches you: email, phone, mailed forms, portal and front desk. Note which ones expose a full card number to staff.
2. Search for stored numbers. Data-discovery tools can scan mailboxes and shared drives for card-number patterns, and your IT provider can run that search.
3. Decide what to purge and what to redact. Retention duties or litigation holds may cover a document that contains a card number. In that case, redact the card data rather than destroying the document, and check with whoever manages records first. Cross-cut shred paper forms that you are allowed to discard.
4. Retire every form with card fields. Replace it with a consent-only authorization and a hosted link.
5. Tell clients your new rule. Add a line to invoices and engagement letters stating that the firm will never ask for a card number by email. That line also helps clients spot phishing that uses your firm's name.
6. File the right questionnaire once card data has stopped reaching your systems.

Start with step two this week, because the inbox search will show you exactly how much exposure you have now. If you want to rebuild intake around hosted pages and tokens, you can request a free payment processing quote, and a MannyPay specialist will respond within one business day.

IC

About the author

Isabella Cruz

Isabella Cruz is Business Growth & Commerce Editor for Beyond the Swipe, writing for small businesses, restaurants, retailers, entertainment venues and e-commerce sellers.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.