"Now it's emerged that those very same confirmation emails contain a web link - ironically intended to direct customers to Argos's security page - which contains the customer's full name, address and credit-card details in the URL itself."

I'm speechless... I may not understand PCI compliance fully but surely anyone with any brains could see that is a bad idea. I mean why would you reveal someone's credit card details in the URL. Not to mention emailing it. This beggars belief.

Edited for typos and readibility.