A good overview of how to detect credit card data (or how difficult it can be) can be found in the blog entry by Ofer found here: http://www.modsecurity.org/blog/archives/2008/01/detecting_credi.html