Do you guys realize that the vendors your buying from online don't even have access to your CC number? When you buy online it's done through a payment gateway such as authorize.net, and a merchant processor. The online vendor simply gets notification that you've paid for your order and the charge was approved, nothing more. I know, because I run an online store. I, nor any of my employee's, could steal my customers info if we wanted to. And no, my online store has nothing to do with ecig's, it's welding supplies.
That said, there are ways they could process themself, but I highly doubt any of the online ecig vendors are doing so. If they retain your cc number, they have all kinds of PCI compliance they have to deal with and it's expensive to do so.
I also don't understand all the fuss about it. Sure, it's a bit of a hassle to have to call your cc company and tell them you didn't make the charges, but do you realize that the stores that the theives are purchasing from ARE going to be out that money? As soon as you report the fraud on your card, their bank account gets automatically debited for the purchase and you get refunded, before they are even notified. In the meantime, the thief is off to sell their product on ebay.
There is absolutely nothing they can do about it either, other than file a police report and hope their goods can be recovered and returned to them. Yea, good luck with that.