This is a classic scoping problem with compliance standards. Hold the merchant fully accountable -- but completely negate all of their efforts if the merchant's customer didn't protect their browsers.
However, what does remain questionable for scoping is if the merchant has CSR reps or employees/contractors/consultants of any kind (back-office, via business intelligence, CRM, accounting, officers, or otherwise) using a browser or other app to access payment card data.
I have heard that there is an exclusion for merchant elected individuals who access the cardholder data in the same way that a customer would -- however this is up to the QSA (the PCI DSS assessor) to decide: i.e. it is their discretion.
In order to prove that the above information is accurate, allow me to cite Gene Kim's PCI Scoping work, which in a series of slides -- he discusses using IIA's (responsible for COSO) GAIT-R for compliance "principles" identification versus "controls" identification (of which PCI DSS is heavy with). This is classically described as "The Spirit of the Law" versus "The Letter of the Law" in criminal/civil justice and legal reformation acts since the history of mankind.
In slides 35 and 37 of 2010 07 BSidesLV Mobilizing The PCI Resistance 1c, it is clear that:
- Category 3 devices are outside of PCI DSS scope, while Category 2 and 1 devices are in PCI DSS scope
- Devices that transmit CHD, are not able to decrypt the CHD, and are also not connected via local physical/virtual network segment to a Category 1 device CAN BE CONSIDERED as either a Category 2A, 2B, 2C, or even a Category 3 device
- According to the scoping, the customer (or those who transmit the CHD exactly like a customer) is considered a Category 3 device (and thus out of PCI DSS scope). The trick here is to make sure that the CSR rep (or other merchant employee/contractor/consultant) is not also violating any other scoping workflow as dictated in slide 37, such as caching CHD via the browser (or proxy, application-layer-gateway, etc) or saving the CHD in browser HTML-Form autocomplete functionality
- I honestly feel that you need to owe me a beer for answering this