A repeat customer shouldn't have to hunt for a wallet every time they buy from you. Saving their card can be a useful little courtesy. It also creates a promise that lasts longer than the order: you'll look after what they leave behind.
Revolve is notifying customers after unauthorized access to its online shopping platform, according to reporting published November 2. In its October 29 SEC filing, the fashion retailer said an attacker may have obtained names, contact information, payment-card numbers and expiration dates for certain customers who saved payment information in their accounts.
The company said it had remediated the unauthorized activity, brought in outside cybersecurity experts and notified federal law enforcement. It also reported no operational disruption or interruption to customer service. As of that filing, Revolve didn't believe the incident would materially affect its business.
A store can keep taking orders while customers have a separate problem to deal with. That's the part I'd keep in view here. Whether an incident materially affects a company and whether it exposes a shopper's payment details are different questions.
The convenience has an afterlife
For a small retailer, repair business or service firm, repeat purchases are worth making easy. Asking an established customer to type everything again can feel like sending them back to the beginning of the relationship. I wouldn't dismiss saved payment cards as a bad idea. I'd want the convenience to come with a clear explanation of what is actually being saved.
Revolve's filing doesn't explain its payment architecture or the precise way the attacker got in. It doesn't establish that another shop using saved payments has the same exposure. The useful question for your business is much closer to home: when a customer chooses to save a card, what information does your business retain, and what stays with the payment provider?
Consider an illustrative example: a local shop keeps a customer's order history so staff can find the right replacement part next year. That history has a clear purpose. Whether the shop also needs to retain payment-card details is a separate choice. Keeping evidence of the sale doesn't automatically require keeping everything collected during it.
The FTC's business guidance makes a practical distinction here. It advises businesses to keep sensitive information only when there is a legitimate need, and only for as long as necessary. It specifically cautions against retaining card numbers and expiration dates without an essential business reason. That leaves room for a considered decision about recurring payments, rather than treating every saved field as harmless clutter.
Follow one saved payment
I'd start with one ordinary customer purchase and have the person responsible for your checkout explain where the payment information goes. If the answer is simply that the provider handles it, ask what your own staff can still see, retrieve or export. Ask how a saved payment method is removed and what records remain afterward. An actual walkthrough is more useful than another reassuring adjective in a sales brochure.
Use that explanation to decide which information earns its place and when it should leave. Keep necessary accounting and transaction records under the appropriate retention rules. If you change how payments are saved, test the customer experience and any recurring billing before rolling it out.
The next order should be easy. The promise attached to the last one deserves just as much care.
Sources and further reading
