If you were to hire an anti-fraud specialist for your firm, and that supposed specialist began asking your customers to send full images of their credit cards, front and back, with sensitive details clearly visible, would you be even the slightest bit concerned? Most reasonable people would see that as an immediate red flag. After all, the very purpose of fraud prevention is to reduce exposure to risk, not introduce new vulnerabilities through questionable practices.

And yet, this is precisely the kind of behavior that is being justified here.

Clearly, French-based cloud provider OVH Cloud do not seem troubled by this contradiction. They claim to have an “anti-fraud” team in place, an entity that should embody best practices in safeguarding user data and minimizing security risks. But when that same team instructs customers to transmit highly sensitive financial information, like credit card images, via email, it raises serious concerns about their understanding of basic security principles.

Email, as a communication channel, is fundamentally insecure for transmitting confidential data. Messages can be intercepted, misdirected, stored indefinitely on multiple servers, or accessed if an account is compromised. Encouraging customers to send payment card details without making it clear that all but the remaining 4 digits needs to be redacted, through such a medium does not just skirt the edges of acceptable practice. It crosses well into territory that most security professionals would consider negligent.

An anti-fraud team that promotes this kind of behavior is not functioning as a protective measure. It becomes a potential liability. The irony is hard to ignore. In attempting to verify identity, they are effectively asking users to engage in the very behavior that fraud prevention guidelines universally warn against.

This was not a hypothetical scenario. It was my actual experience while searching for a new web hosting provider. When I attempted to proceed with setting up a server, I was instructed to provide verification by emailing images of my credit card. Understandably, this request felt inappropriate and unsafe.

What is perhaps more concerning is that, despite these issues being raised, they continue to insist that this process is “PCI-compliant.” That claim, on its face, seems difficult to reconcile with widely accepted interpretations of PCI DSS, the Payment Card Industry Data Security Standard, which emphasizes minimizing the storage and transmission of cardholder data, especially through insecure channels.

At best, this suggests a troubling disconnect between policy and practice. At worst, it reflects a systemic misunderstanding of what genuine fraud prevention should look like in a modern, security-conscious environment.

There are now companies out there who specialise solely in identity verification, for use cases such as employment checks, or indeed purchasing certain product’s such as cloud servers. There are plenty of better, more secure ways to verify someone’s identity without having for pose for selfies with your credit card.

It’s clear that OVHCloud didn’t get the memo that’s it’s no longer 2005.

The TLDR of this is just don’t hire any former OVH Cloud employees as your security consultant, or could be open to numerous data breach litigations.

Have you been affected by anything mentioned in this article and want to have your story heard? Contact us at press@bluecitycapital.com