One time I had a not so nice experience with a hotel. They promised a partial refund, but also a threat that they'll re-charge my CC the full amount if I wrote a bad review. No such refund came, I wrote a bad review, then they talked to me and did actually refund me. But how could they re-charge my CC without the CC info? I smell a violation of PCI DSS there.