> The best practice is a policy banning PAN over email, instant messaging, SMS, and chat entirely.

Sounds silly to me. A PAN should never even touch an employee's computer.

There are cases for card not present transactions, fraud and complex refunds but generally yes.