This local-ish place I pay a bill to each month claims #PCI compliance yet they're obviously storing CC #s on their site. Probably 95% it's just incompetence, not shady. I've complained about it. Now they're using a password field for the #. I doubt if they've solved the problem.