This seems to be an unfortunate trend for American Express this week making headlines with disgruntled workers for the plastics giant. One looming question remains: Aren't the issuers and acquirers held to the same level of accountability (from a security perspective) regarding PCI-DSS as they hold their merchants? Access control seems to be absent entirely and encryption a total afterthought.