PCI is pretty strict, the regulations went through a massive overhaul 2 or 3 years back. Even over the phone there is software to mute to a operator when you verbally say bank details (at many financial companies) and that data is then held encrypted often by an approved third party provider so even the business may not have this data (only a key to it). With email apart from being unsecured in transit and storage, that information may also be entering a business at a low level, what I mean by that is at a clerk level in a junior data entry role, these staff are required to be trained around PCI and compliant but it wouldn't be considered fair to say that makes them security experts around this (they could be 18 and stated last week).