Payment Mix and Card Data at Hide & Stitch

Per 100 orders (average value PKR 9,400):

COD: 14 are refused, so 86 are collected = PKR 808,400 revenue. Costs: courier PKR 180 × 100 = 18,000; cash handling 1.5% of 808,400 ≈ 12,126; return logistics 320 × 14 = 4,480. Total ≈ PKR 34,600, plus the lost margin on 14 units that were packed, shipped and never sold.

Card: 0.9% chargeback loss leaves ~PKR 931,540 collectable. Gateway cost ≈ 2.9% × 931,540 (27,015) + 25 × 100 (2,500) = PKR 29,515. Total ≈ PKR 29,500, with no return-logistics exposure.

Card is cheaper on the same volume - but dropping COD entirely is the wrong conclusion.

• 68% of current volume is COD. Those buyers are, by revealed preference, not card-ready; removing COD removes the order, not the cost.
• The comparison above assumes identical volumes, which will not hold.

Better move: keep COD but de-risk it - require a PKR 1,000 partial advance (wallet or Raast) on COD orders, which filters casual buyers and typically cuts refusal sharply; add wallets and Raast at low cost; and offer a small card-only incentive rather than a COD penalty. Measure refusal rate per cohort after 30 days. Full COGS is not in the brief, so treat the ranking as indicative and re-run with margin data before any decision.

This is the most urgent item in the case - it is a live liability, not a housekeeping issue.

Exposure:

• Storing card numbers in a plain spreadsheet means the data is almost certainly outside any gateway tokenisation, unencrypted at rest, shared by email, and on a laptop that may not even be patched. A single lost device becomes a card-fraud incident affecting customers who trusted the shop.
• The gateway/acquirer contract will contain data-handling terms the merchant is now breaching. That is a contractual and commercial relationship risk, independent of any criminal law.
• The shop cannot honestly answer a security questionnaire, and the acquiring bank can withdraw card acceptance.

Actions, in order:

1. Stop collecting and stop storing. Delete the spreadsheet file and any copies (email attachments, backups, personal drives) - securely, not to the recycle bin.
2. Never store CVV under any circumstances; that is prohibited even when encrypted.
3. Switch to the gateway's tokenisation / saved-card feature, so a reusable token replaces the number and the merchant never holds the PAN.
4. Restrict who can see customer records, enable MFA on the admin panel, and write a one-page data-handling rule for staff.

Do this before the campaign, because the Eid surge multiplies both the volume of data collected and the number of staff handling it.

The discount is aimed at the wrong diagnosis.

A 71% abandonment rate is close to normal for the region; the informative number is where people leave. Thirty-eight percent dropping specifically at payment points to friction and trust, not price:

• no wallet or bank-transfer option for buyers without cards;
• forced account creation;
• opaque COD terms (does the buyer pay the courier? can they open the box?);
• a checkout that looks unfamiliar on a phone.

A 15% discount on a PKR 9,400 basket is PKR 1,410 - a permanent, uncapped giveaway that trains repeat buyers to wait for the next promotion and does nothing about the buyer who abandoned because they had no way to pay.

Alternative plan, cheapest first:

1. Guest checkout and address autofill - pure configuration work.
2. Add Raast/wallet at checkout.
3. Rewrite the COD terms block in plain Urdu and English; add a returns promise above the pay button.
4. Add a single exit-intent prompt capturing a phone number for a courier-reminder, not a discount.

Testing: run a two-week A/B test, payment step measured separately, and only consider a discount for the segment that abandons at the cart page (price-sensitive browsers), where price may genuinely be the blocker. Discount is the last lever, not the first.