Well an external suitelet could work if the link emailed have the customer ID then you open your external suitelet URL with a get parameter with the customer ID and from there taking the card information....