I tried to reduce the attack vector as much as I could. The credit card number is passed from the front-end to the server to be tested for checksum. The credit card information is NEVER logged, stored, and surely not sent via email. The site has an SSL certificate and forces use of https. Soon I will put the check in JavaScript and NEVER pass the data beyond the client further mitigating risk.