to its credit card processors." In just one single purchase at the register, masses of personal data is collected which when stolen has major ramifications. The financial infrastructure and payment system will continue to be a work-in-progress as it constantly is at battle with security hackers. Regulation and governance United States While not federally mandated in the United States PCI DSS is mandated by the Payment Card Industry Security Standard Council, which is composed of major credit card brands and maintains this as an industry standard. Some states have incorporated the standard into their laws. Proposed toughening of federal law The US Department of Justice announced in September 2014 that it will seek to impose a tougher law to combat overseas credit card trafficking. Authorities say the current statute is too weak because it allows people in other countries to avoid prosecution if they stay outside the United States when buying and selling the data and do not pass their illicit business through the U.S. The Department of Justice asks US Congress to amend the current law that would make it illegal for an international criminal to possess, buy or sell a stolen credit card issued by a U.S. bank independent of geographic location. Cardholder liability In the US, federal law limits the liability of cardholders to $50 in the event of theft of the actual credit card, regardless of the amount charged on the card, if reported within 60 days of receiving the statement. In practice, many issuers will waive this small payment and simply remove the fraudulent charges from the customer's account if the customer signs an affidavit confirming that the charges are indeed fraudulent. If the physical card is not lost or stolen, but rather just the credit card account number itself is stolen, then federal law guarantees cardholders have zero liability to the credit card issuer. United Kingdom In the UK, credit cards are regulated by the Consumer Credit Act 1974 (amended 2006). This provides a number of protections and requirements. Any misuse of the card, unless deliberately criminal on the part of the cardholder, must be refunded by the merchant or card issuer. The regulation of banks in the United Kingdom is undertaken by the: Bank of England (BoE); Prudential Regulation Authority (PRA) a division of the BoE; and the Financial Conduct Authority (FCA) who manages the day to day oversight. There is no specific