Don't be under the impression that reporting a PCI violation will matter. They'll just apply a bandage if anyone looks into it. The real risk is if they have a breach, then they'll be liable for more fines. I know businesses that are very successful and ignore PCI. One even sold for a large amount of money. They implemented BrainTree in a week to solve a due diligence issue. No big deal. Sure, if they'd been hacked it'd have really hurt, but they weren't and now have FU money.

For it to actually really hurt your competitor, you'd have to probably astroturf some forums, acting like concerned customers, and get other customers upset. And even then, you're just going to cost them a week or so. Maybe if you timed it for maximum damage, but just don't waste too much time on it.