If someone succeeds in breaking into the merchant's server, the entire database of credit card numbers may be compromised. VPNs employ tunneling, encryption, authentication and access control. There are two categories of tunneling. PCs at both ends establish the tunnels and encrypt and decrypt data between the two computers. The data is encrypted and tunneled to the remote users.
Stronger encryption is clearly necessary for any serious security.
However, the debate rages between security and privacy advocates. Some government and law enforcement agencies oppose the use of stronger and unbreakable encryption keys, citing national security and law enforcement reasons. They don't want terrorists, drug dealers and other criminals to have absolutely unbreakable encryption. On the other hand, privacy advocates are concerned about the security of individuals' private information from both government and online criminals. Both advocates have strong arguments, and it may be some time before technology and legislation strike a balance.