Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data.
It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.
It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.
Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here:
https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1....
At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.
You can ignore my comment about the /payments page, I'll assume you checked that, so yeah, that's insane if you can update payment information on an insecure page.