Pretty much:( Usually lots of tens of thousands. Luckily PayPal and Google Checkout are getting more popular, but still, it just feels sort of ghetto, imho. The vast majority of small eCommerce sites out there are almost certain not PCI compliant, or at least not properly audited by an accredited 3rd party.

It's sort of like speeding, but with bigger tickets. Most people do it, but it's risky.