> Aside from the part where a vendor is required to keep your card number for refunds... Vendors aren't required to retain the full card number. They are requi

> Aside from the part where a vendor is required to keep your card number for refunds... Vendors aren't required to retain the full card number. They are required to retain the last 5 digits (or last 4, I'm not 100% positive), as well as the transaction time. When a chargeback or refund comes around, they'll cross reference multiple forms of identification on the transaction, but they'll never have to handle the full card number. All card readers are a two part solution. A hardware reader (USB, serial, whatever) is useless without some sort of {firm,soft}ware behind it. With Square, consumers will be trusting whoever they hand their card to be running current and legitimate software. How this is any different than me handing my card to an entirely random person at the corner store I don't understand, except this time I could write an alternate application to process the transaction myself without having to use a JTAG cable as I would for one of Verifone's closed systems. edit: clarification of last paragraph.