Starbucks.com isn't https and asks for credit card # to retrieve payment history

If its not a credit card that should be made more clear. I thought I should submit my credit card before posting this on HN to see if I was being delusional.

1. The language just says "Card number" and that they ask for security code I would think most people would assume means credit card number as one wouldn't think a Starbucks code would have a security code.

2. Many people only use the Starbucks app so most of their interaction with a Starbuck's "card" is using their credit card which they use to refuel the app.

Having many people mistakenly enter their credit card into this form is very, very bad and can be easily avoided by adding one word to the page: "Starbucks" vs "Credit" card. In general, a pretty terrible oversight.

You can transfer the balance to your own card using the information stated, I believe.

Wouldn't it be that persons job to advocate for SSL? I can't imagine it's that hard to sell "bank-level encryption to prevent a Target-like credit card leak" to the higher ups, especially at a company as relatively tech-forward as Starbucks.

Again, it is not your credit card number they are asking for, it is your Starbucks gift card.

You can also manually change the URL to https, without logging in. A redirect would be good practice.

Doesn't mean they don't accept credit card information, by that I mean I doubt people -only- enter starbucks cards. Still a method for people to transfer their credit card information insecurely.