Let's also understand that Regulation is about the access device, and in an online transaction, the card number (typically with the expiration date and often the CVV) constitutes the access device. If the information is stolen from the card, I believe that would constitute the loss or theft of an access device.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8