That was also the case for a number of ACH portal softwares sold alongside retail POS suites in the 2000s. Instead of temporary storage until batching, full transaction details were held permanently by default.

At any time, anyone with access to a payment terminal who knew where to look could process transactions manually from these records. They could have double charged and skimmed, done reversals for a cut, or copied and sold customer profiles with CC numbers. These were BSA products marketed to small and medium sized businesses, so no one questioned compliance.

I prefer to put consequences in terms of money.

That said, on the flip side, because of things like "Dual Control" the PCI DSS is physically impossible for some small companies to abide by. In the past we dealt with credit cards and had a few audits, and they admitted that many of the points are aimed at companies that don't consist of just two people.

Also, look at it from their POV. In a normal course of business a lot of these mom and pops probably already are storing credit card information on paper and/or in word documents. So you're saying the system you build for them is going to be, in some ways, less useful than their current ad-hoc system.

My mom & pop tax guy emails me my tax return as an encrypted pdf, with the password being... the last 4 digits of my SSN.

Oh there is no question if you bring paper records in to the mix there are enormous opportunities. I worked at a mom & pop restaurant for several years. In the attic of the restaurant were stacks of boxes with credit card receipts dating back to the mid-80s at least. While the chances of many of these cards being valid now are significantly reduced, there is always that slight chance. I have a credit card from the early 90s that the number has not changed (kind of nice in a way as I can recite the number by memory now).

On the flip side though, to some extent, I would consider these records safer than a website. At least to gain access to these records you would have to physically enter the building, climb in the attic, sift through hundreds of boxes, gather the info you want, and then leave. This would also require you be in the general location of the building and have knowledge of the records being there. Hacking a website database from across the globe is a whole lot easier, so you I would say that their existing paper system is more secure to a degree.