We are internet programmers who have integrated many third party credit processing options for many different clients, both large and small. While the credit gateways have policies about storing you personal information and generally do not allow important credit information to be shared, they do not run the servers that are running the websites that you're entering your information into.
What does this mean?
It means that despite the ever commonly trusted "https://" and familiar "SSL" terms that float around the internet in hopes of keeping the general public unaware of the risk involved with online transactions, the possibility of credit theft is pretty much left in the hands of those who run the websites you're entering your information into.
Duuuh... what does this mean?
Ok, let's slow it down. Say you go to "joes-bargain-boots.com" and see that he has a shopping cart that offers paypal as well as an on site visa or mastercard payment option. You, for reasons beyond comprehension, decide that you don't trust paypal and go with the onsite processing option.
You enter your credit information as typically done on the internet, thinking you are safe because you see the url reads https://www.joes-bargain-boots.com and he has a fancy SSL verification on the site.
Your transaction goes as expected and a few weeks later you get your boots. Great. Meanwhile, Joe decided to ignore general payment gateway policies and went ahead and stored your credit card number, expiration date, special three digit number on the back of the card, and any other information you foolishly entered when you were filling out the payment form on his "secure" website.
While Joe himself may not have malicious intentions, the bored hackers of the internet decide they want to test his security, considering he takes online payments and therefore could be a profitable hack.
While SSL and https are good ways prevent any interceptions while the transaction takes place, they are useless if Joe, the idiot champion of the internet, forgot to secure his ajax scripts and the hackers dump his whole database by typing a few lines into the url.
Now some guys in Pakistan are encoding blank credit cards with your information and sending them back to their buddies in the good ol' US of A, where they can have a ball with their new found wealth.
If only you went with PayPal. The cart on this site transfers you to PayPal before you enter any information, so there's no security risk there. What's more, PayPal has a general $1,000 buyer protection policy that keeps you from losing out on jerk merchants and their scams, failures to ship, or bad business practices.
Furthermore, PayPal is a bank. They have better rates because their overhead is much less than normal banks that have dozens of physical locations in every city.
They are a gigantic online payment handler and therefore are required to have many millions of dollars in insurance to protect the users of their service. If their servers were comprimised, you're covered. Can Joe and his bargain boot site say the same?
Think about that next time you're filling out your credit card information on any website. If you're not positive about the organization running the site, you could be making someone's day in Pakistan.