[eCa]

Unless they are PCI compliant [1] they really (really) shouldn't, and would deserve any (and all) kind of hurt that's coming to them.

[1] https://www.pcisecuritystandards.org/