PCI: protecting charity shops and their customers