I agree that if there were more consequences for compromised businesses, there would be fewer compromises... but it would also massively raise the barrier to ge

I agree that if there were more consequences for compromised businesses, there would be fewer compromises... but it would also massively raise the barrier to getting a merchant account. Essentially, you'd live in a world where everyone used paypal or something like it. (I think apple pay would be in the running, too, but I think this might end up being natural-monopoly-ish) The best way to solve the problem, I think, is to quit using shared secrets across minimally trusted parties. Public key cryptography is... I'm not going to say unbreakable, but it's pretty good. it's fairly secure. We need to enforce that on all physical card readers, which will make 'skimming' rather a lot more difficult, and then after that we need to figure out a card reader users can use on their computers and cellphones. The technology is mostly there; most of my cellphones support some kind of secure wireless public key stuff, and most of my phones do too. We need to make this ecosystem work well, solve the software problems, and then make it so that your credit card number is just an identifier, not an authentication token.