Here are the main areas of the site that could become a security concern:
The site works as a general ledger system against the company and its users.
The ledger system is to keep track of small deposits ($0.10 up to $10.00). Some users have amassed decent sized accounts (upwards of $100's of dollars) but the vast majority have little or nothing in their accounts.
The site allows users to withdraw money from their account (with the site) to their Paypal account.
- They can also send money into their student card (if they happen to be a student).
Now, as far as I know, PCI only covers credit & debit cards, not student cards.
What security laws would need to be considered in this situation?