So if I'm understanding this right, the big issue they have is that they're not telling the customers that they're doing it. Can't any website do exactly the same thing in recording every keystroke written into it without a customer knowing?
Does it really even matter if you're sending them your credit card details anyway?