for some topic drift ... having worked on the original payment gateway using SSL to "hide" payment related information as fraud countermeasure (for what has since come to be called electronic commerce)
http://www.garlic.com/~lynn/subnetwork.html#gateway

but then got involved in x9a10 financial standard working group that in the mid-90s had been given the requirement to preserve the integrity of the financial infrastructure for all retail payments.
http://www.garlic.com/~lynn/x959.html#x959

one of the things looked at in x9a10 is defining x9.59 financial standard protocol to eliminate risk/fraud associated with exposure of things like account numbers, expiration dates, etc. recent post noting that eliminating the risk associated with exposing account numbers and expiration dates ... somewhat obsoleted the earlier work on electronic commerce that used SSL cryptography to hide the same information.
http://www.garlic.com/~lynn/2007i.html#65

which also goes back to long series of posts started here with regard to the naked payment/transaction metaphor
(i.e. naked transactions tend to require quite a bit more hiding and protection than transactions that are more robust and armored)
http://www.garlic.com/~lynn/subintegrity.html#payments

then there is the somewhat related recent posts that somewhat raises the question whether or not some of the fraud problems is because of semantic confusion attempting to understand what various security procedures actually accomplish
http://www.garlic.com/~lynn/2007i.html#74
http://www.garlic.com/~lynn/aadsm26.htm#65