"Reporting" someone for a PCI violation won't do much. At most they might lose their certification level temporarily as their PCI auditor makes them implement f

"Reporting" someone for a PCI violation won't do much. At most they might lose their certification level temporarily as their PCI auditor makes them implement fixes. In fact there might even be a grace period for them to fix problems, so no action will be visible to their customers. Even if they lose PCI certification, that's not something customers look for or know about. If you want to damage their reputation, write a blog post in a way not traceable to your company exposing the actions of your competitor. Or get a news agency to notice, and be an anonymous source. This probably isn't worth the trouble. The white hat solution, as others have mentioned, is tell them. If they don't have the problems resolved within some reasonable time span (a month if you're feeling mean, 6 months if you're feeling nice), then I would say you're morally justified in smearing the hell out of them.