For business merchants, especially smaller companies, the competitive pricing offered by some CSPs makes them an obvious, and perhaps the only affordable, path to e-commerce. The danger is that many CSPs are little more than garage operations, without telephone listings or even rudimentary security. Even larger, well-credentialed CSPs may have primitive ideas about what constitutes good security.

Jim Balderston, an analyst with Zona Research, suggests that merchants who rely on router-based security alone to protect credit-card information may leave themselves open to charges of failing to exercise due diligence. "Banks and credit-card companies are now putting their servers in secure locations the way that merchants put their cash proceeds in a vault," Balderston says.

While credit-card liability is rarely a major issue for those who buy from e-commerce sites, the liability for merchants can be significant. Forrester Research estimates that a $1 million theft from an online bank (say, 1,000 accounts at $1,000 each) will cascade into a $100 million loss after factoring in network downtime, audits, bad publicity, insurance hikes and fleeing customers. More sobering, Forrester further asserts that about half of all online attacks succeed.