[gregjor]

You did what you can do. Maybe point them to their merchant agreement and PCI compliance rules. I've run into this before and clients have paid be to fix the problem.