All businesses involved in taking credit card payments, or processing and storing payment details have been responsible for making sure they comply with regulations laid down by the Payment Card Industry's Security Council which was formed in 2005.

These regulations known as the PCI DSS or Data Security Standards are regularly updated in order to circumvent new methods of fraudulent activity taking place when customer's pay for goods and services with credit cards online.

Although the regulations are set up on a voluntary basis i.e. they are not legal requirements, lack of compliance with them by merchants could mean that they will no longer be able to trade by taking credit card payments – something which could put them out of business.

One of the main reasons the PCI DSS regulations first came into existence is because banks had to reissue so many credit cards due to fraud, which involved a high degree of cost. Just one breach of security means that hundreds or even thousands of cards have to be reissued. In an attempt to recoup their costs banks started to pass on higher fees to merchants and customers. In order to halt the rise in fees the credit card companies decided to impose the PCI DSS codes of practice.

Small firms as well as large online retailers are required to be PCI compliant. If a small e-business suffers a breach of security their bank can freeze funds in order to cover the breach or even shut them down. The PCI Security Council can impose big fines on companies who have laid themselves open to hackers whilst lacking PCI compliancy.

With hackers and fraudsters finding ever more innovative ways of accessing data there is always the possibility of information becoming compromised but at least e-commerce sites will not be punished by industry for this occurrence so long as they maintain and run their websites in line with industry initiatives.