. "All internal communications regarding accounts should be done using information other than the card number such as a serial number in the database relating to the account." . . .