Ordered some stuff from www.surfasonline.com the other day. I was
disturbed to find that displaying my order status showed my CC# and
security code. I was also disturbed that the site stored a login
cookie without my permission, so that anyone on my computer could
access the site and see my order. Or change my account preferences.
Most sites will screen out all but the last 4 digits of your CC#. And
to change account information typically requires reentering your
password.

Just a heads up.