I worked for a much smaller place with far less resources than Amazon (which is what Zappos is) and our PCI compliance as a payments processor was rock solid.

I worked for a much smaller place with far less resources than Amazon (which is what Zappos is) and our PCI compliance as a payments processor was rock solid. Our systems were under attack all the time from all corners of the globe and we never suffered a breach. If you can't manage PCI compliance then you shouldn't be involved with credit cards.