Yeah, for some reason the big banks seems to be the worst, and they're the ones supposed to be setting the standards in the first place.
Is rather worrying to have someone at a (relatively small) company having to tell a multinational financial company not to send a bunch of live credit cards as test data. :/