facebook as a platform provider is guilty as charged.

there is a special form enforced for storing credit card information. Where was QSA?

Credit card providers and game providers should also take their part in responsibility for storing credit card information.

I do not get how is this still possible with 3D secure protocol out there?