When something is described as an “SEC violation” on a credit card, the term is almost always being used loosely. The Securities and Exchange Commission does not regulate credit card processing. In nearly every case, the phrase refers to a security, compliance, or consumer protection violation tied to how a business handles card transactions: a failure under the Payment Card Industry Data Security Standard, a breach of federal consumer protection law, or an infraction of the rules that Visa, Mastercard, American Express, and Discover enforce directly. There is one real SEC connection, but it only applies to publicly traded companies.
What People Usually Mean: PCI DSS and Data Security
The most common referent is a violation of the Payment Card Industry Data Security Standard, known as PCI DSS. Every business that processes, stores, or transmits credit card data has to follow it. The current version is PCI DSS v4.0.1, which became the only active version of the standard after v4.0 retired at the end of 2024, and new requirements under v4.0.1 became mandatory on March 31, 2025. The standard covers network security, encryption, vulnerability management, access controls, and monitoring.
Many of the failures are basic. Storing sensitive authentication data after a transaction is authorized, including the three-digit security code on the back of a card, is flatly prohibited. So is transmitting cardholder data over unencrypted connections or leaving default passwords in place on payment systems. PCI DSS also requires regular vulnerability scans, penetration testing, and limiting data access to employees who actually need it.
PCI DSS is enforced by the card brands, not the government. When a merchant falls out of compliance, the acquiring bank (the bank that processes the merchant’s card transactions) passes along fines from the card brands. Early-stage non-compliance fines often start in the range of $5,000 to $10,000 per month and escalate the longer the gap persists. If a data breach occurs while a merchant is non-compliant, breach-related penalties can reach $500,000 per incident, on top of the costs of forensic investigation, card reissuance, and customer notification.
Separately, every state, the District of Columbia, and U.S. territories require businesses to notify affected individuals when their personal information has been compromised. All states require notice without unreasonable delay, and many set specific deadlines, commonly 30, 45, or 60 days after discovery.1National Conference of State Legislatures. Security Breach Notification Laws A business that processes cards in multiple states has to comply with every state’s law that covers affected residents.
Consumer Protection Violations Under Federal Law
Section 5 of the Federal Trade Commission Act declares “unfair or deceptive acts or practices in or affecting commerce” to be unlawful.2Federal Trade Commission. A Brief Overview of the Federal Trade Commissions Investigative and Law Enforcement Authority In credit card processing, this covers hidden fees that were not disclosed before the transaction, charges that exceed the amount a customer agreed to, misleading subscription terms that make cancellation difficult, and failing to deliver promised refunds.
The FTC also expects businesses to maintain reasonable security practices for the data they collect. A company that promises on its website to encrypt all payment data but actually stores card numbers in plain text has committed a deceptive practice even if no breach has occurred.3Federal Trade Commission. Privacy and Security
Charging a customer’s card without consent sits at the intersection of consumer protection and federal lending law. Under the Truth in Lending Act, a cardholder’s liability for unauthorized use of a credit card is capped at $50, and that cap only applies when the card issuer has met several conditions, including providing notice of potential liability and a way to report unauthorized use.4Office of the Law Revision Counsel. 15 US Code 1643 – Liability of Holder of Credit Card Most major card issuers waive even that $50 as a matter of policy. Recurring billing is a frequent problem area. If a customer cancels a subscription and the merchant keeps charging, each subsequent charge is unauthorized regardless of what the original terms said about auto-renewal.
Payment Network Rules Merchants Break
Visa, Mastercard, American Express, and Discover each publish detailed operating regulations that merchants agree to follow when they accept cards. These are private contractual rules, not government laws, but the card brands enforce them through fines and account restrictions. Several of them turn up often enough that a cardholder may see the behavior and call it a violation.
Surcharging
Merchants can add a surcharge to credit card transactions to offset processing costs, but the rules are tight. Visa caps surcharges at 3% of the transaction amount, and Mastercard caps them at 4%. Several states prohibit surcharging entirely. Surcharging a debit card transaction, failing to disclose the surcharge before the transaction, or exceeding the cap all violate network rules and may violate state law.
Minimum Purchase Amounts
Federal law allows merchants to require a minimum purchase for credit card transactions, but the minimum cannot exceed $10 and must apply equally across all card brands.5Office of the Law Revision Counsel. 15 US Code 1693o-2 – Reasonable Fees and Rules for Payment Card Transactions A store that sets a $15 minimum for Visa purchases or imposes a minimum on debit card transactions is violating both federal law and network rules. This provision comes from the Dodd-Frank Act and applies nationwide.
Chargeback Handling
When a cardholder disputes a transaction, the card brands set specific procedures. Visa gives merchants 30 days to respond to each phase of a chargeback, while Mastercard allows 45 days. Missing the deadline, submitting incomplete documentation, or re-charging a customer for a transaction already resolved through a chargeback all violate network rules. Merchants with chargeback ratios above roughly 1% of transactions are flagged for monitoring and face escalating penalties.
When It Really Is the SEC
The Securities and Exchange Commission enters the picture only for publicly traded companies, and only around disclosure. The SEC does not regulate credit card processing itself, but it does require public companies to disclose material cybersecurity incidents, which includes significant breaches of payment card data. A public company that suffers such a breach and fails to disclose it properly has committed a genuine SEC violation.
Under rules adopted in 2023, a public company must file a Form 8-K within four business days of determining that a cybersecurity incident is material. The filing has to describe the nature, scope, and timing of the incident, along with its actual or reasonably likely impact on the company’s financial condition.6U.S. Securities and Exchange Commission. Public Company Cybersecurity Disclosures Final Rules Disclosure can be delayed only in a narrow case, when the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety.
Beyond incident reporting, Regulation S-K Item 106 requires annual disclosures about the company’s cybersecurity risk management processes, whether management has relevant expertise, and how the board of directors oversees cybersecurity risk.7eCFR. 17 CFR 229.106 (Item 106) Cybersecurity For a retailer or payment processor handling millions of card transactions, these disclosures carry real weight with investors, and the SEC has shown willingness to pursue companies that downplay cybersecurity vulnerabilities.
If you are a cardholder and someone tells you a merchant committed an “SEC violation” involving your card, the merchant is almost certainly not a public company and the real issue is one of the categories above. If the merchant is a public company, the SEC piece sits alongside, not instead of, the PCI, FTC, and network rules.
What the Penalties Look Like
The consequences stack up from several directions at once. Card brand penalties for PCI DSS non-compliance start in the low thousands per month and can climb to $100,000 per month for prolonged non-compliance, with breach-related penalties up to $500,000 per incident on top. These fines flow through the acquiring bank, which can also terminate the processing relationship and place the merchant on the MATCH list (Member Alert to Control High-Risk Merchants), a database maintained by Mastercard where records remain searchable for five years.8Mastercard Developers. MATCH Pro
Government enforcement runs separately. The FTC can pursue merchants for consumer protection violations, with settlements for large-scale deceptive practices or data security failures reaching tens of millions of dollars.2Federal Trade Commission. A Brief Overview of the Federal Trade Commissions Investigative and Law Enforcement Authority State attorneys general can bring parallel actions under state consumer protection and breach notification laws, and several state statutes give individuals the standing to sue directly. For public companies, the SEC can add enforcement for disclosure failures or for misleading investors about cybersecurity risk management.