When you're the head of a credit card company which likes to boast their security credentials, how much pressure is there to be security conscious? Not enough apparently...